lkml.org 
[lkml]   [2017]   [Aug]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: drivers/s390/char/keyboard.c kernel stack infoleak
From
Date
On 05.08.2017 03:57, sohu0106 wrote:
> My idea is
>
> struct kbdiacr {
> unsigned char diacr, base, result;
> };
>
> sizeof(struct kbdiacr)=4
>
> here we just set 3 bytes
> case KDGKBDIACR:
> {
> struct kbdiacrs __user *a = argp;
> struct kbdiacr diacr;
> int i;
>
> if (put_user(kbd->accent_table_size, &a->kb_cnt))
> return -EFAULT;
> for (i = 0; i < kbd->accent_table_size; i++) {
> diacr.diacr = kbd->accent_table[i].diacr;
> diacr.base = kbd->accent_table[i].base;
> diacr.result = kbd->accent_table[i].result;
> if (copy_to_user(a->kbdiacr + i, &diacr, sizeof(struct kbdiacr)))
> Is there anything I haven't noticed?

Yes: sizeof(struct kbdiacr) is 3 here.

Thomas

\
 
 \ /
  Last update: 2017-08-05 09:12    [W:0.042 / U:0.068 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site