Re: [PATCH V2] net/nfc/nci: fix infoleak in struct nci_set_config_param

From: weiyongjun (A)
Date: Tue Mar 01 2022 - 23:13:22 EST



From: "Minghao Chi (CGEL ZTE)" <chi.minghao@xxxxxxxxxx>

On 64-bit systems, struct nci_set_config_param has
an added padding of 7 bytes between struct members
id and len. Even though all struct members are initialized,
the 7-byte hole will contain data from the kernel stack.
This patch zeroes out struct nci_set_config_param before
usage, preventing infoleaks to userspace.


How this info leaks to userspace?


nci_set_config_req() convert to use packed 'struct nci_core_set_config_cmd'

to send data, which does not contain hole.