linux-kernel - Re: [PATCH 6/8] char: synclink: fix information leak to userland

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sun, 17 Oct 2010 21:55:34 +0400
From:	Vasiliy Kulikov <segooon@...il.com>
To:	Jiri Slaby <jslaby@...e.cz>
Cc:	kernel-janitors@...r.kernel.org,
	Greg Kroah-Hartman <gregkh@...e.de>,
	Alan Cox <alan@...ux.intel.com>, Arnd Bergmann <arnd@...db.de>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 6/8] char: synclink: fix information leak to userland

On Sun, Oct 17, 2010 at 19:46 +0200, Jiri Slaby wrote:
> On 10/17/2010 05:38 PM, Vasiliy Kulikov wrote:
> > On Sun, Oct 17, 2010 at 17:34 +0200, Jiri Slaby wrote:
> >> On 10/17/2010 04:41 PM, Vasiliy Kulikov wrote:
> >>> Structure new_line is copied to userland with some padding fields unitialized.
> >>> It leads to leaking of stack memory.
> >>
> >> I think your tool has a bug. I must admit I fail to see the padding
> >> which would cause leaks. Could you elaborate?
> > 
> > I didn't use any tool except "grep copy_to_user" :)
> > 
> >     typedef struct { 
> >         unsigned int clock_rate; /* bits per second */
> >         unsigned int clock_type; /* internal, external, TX-internal etc. */
> >         unsigned short loopback;
> >     } sync_serial_settings;          /* V.35, V.24, X.21 */
> > 
> > On x86_64 sizeof(sync_serial_settings) = 4 + 4 + 2 + 2 = 12.
> > The last 2 is padding.
> 
> Ah, good to know that even end of structures is padded.

The rule here is that array of struct has no padding between struct
elements.  So, struct has padding in the end to have good alignment of
the first field of the next array element.

Thanks,

-- 
Vasiliy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/