Messages in this thread | | | Subject | Re: drivers/s390/char/keyboard.c kernel stack infoleak | From | Thomas Huth <> | Date | Fri, 4 Aug 2017 11:09:24 +0200 |
| |
Hi,
On 03.08.2017 15:59, sohu0106 wrote: > > The stack object "kbdiacr" has a total size of 4 bytes. Its last 1 bytes are padding bytes after "result" which are not initialized and leaked to userland via "copy_to_user". > > > diff --git a/keyboard.c b/keyboard.c > index ba0e4f9..76a6d35 100644 > --- a/keyboard.c > +++ b/keyboard.c > @@ -480,6 +480,8 @@ int kbd_ioctl(struct kbd_data *kbd, unsigned int cmd, unsigned long arg) > struct kbdiacr diacr; > int i; > > + memset( &diacr, 0, sizeof(struct kbdiacr) ); > +
I think it would be nicer to simply init the struct with "= {}" directly, i.e.:
struct kbdiacr diacr = {};
And by the way, please have a look at the kernel patch submission guidelines first, especially the COO part here:
https://www.kernel.org/doc/html/v4.12/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin
So looking at your patch, please try to send plain text mails, and sign your patch with a Signed-off-by line (i.e. no anonymous contributions).
Thanks! Thomas
| |