Messages in this thread | | | Subject | Re: drivers/s390/char/keyboard.c kernel stack infoleak | From | Thomas Huth <> | Date | Sat, 5 Aug 2017 09:12:03 +0200 |
| |
On 05.08.2017 03:57, sohu0106 wrote: > My idea is > > struct kbdiacr { > unsigned char diacr, base, result; > }; > > sizeof(struct kbdiacr)=4 > > here we just set 3 bytes > case KDGKBDIACR: > { > struct kbdiacrs __user *a = argp; > struct kbdiacr diacr; > int i; > > if (put_user(kbd->accent_table_size, &a->kb_cnt)) > return -EFAULT; > for (i = 0; i < kbd->accent_table_size; i++) { > diacr.diacr = kbd->accent_table[i].diacr; > diacr.base = kbd->accent_table[i].base; > diacr.result = kbd->accent_table[i].result; > if (copy_to_user(a->kbdiacr + i, &diacr, sizeof(struct kbdiacr))) > Is there anything I haven't noticed?
Yes: sizeof(struct kbdiacr) is 3 here.
Thomas
| |