info leak -- padded struct copied to user

PATCH Albert Cahalan 1 participant 1 message Jul 17, 2003 VFS

lore

Share & tools

lore

Albert Cahalan

author

2003-07-17 23:28 UTC #0 lore raw

It's not OK to leak bits of the kernel stack.
(timy security flaw) I found this with -Wpadded.

fs/stat.c +1 -0

diff -Naurd old/fs/stat.c new/fs/stat.c
@@ -123,6 +123,7 @@
 	SET_OLDSTAT_UID(tmp, stat->uid);
 	SET_OLDSTAT_GID(tmp, stat->gid);
 	tmp.st_rdev = stat->rdev;
+	tmp.__pad_16bit = 0;  /* don't leak kernel stack data! */
 #if BITS_PER_LONG == 32
 	if (stat->size > MAX_NON_LFS)
 		return -EOVERFLOW;

include/asm-i386/stat.h +1 -0

diff -Naurd old/include/asm-i386/stat.h new/include/asm-i386/stat.h
@@ -9,6 +9,7 @@
 	unsigned short st_uid;
 	unsigned short st_gid;
 	unsigned short st_rdev;
+	unsigned short __pad_16bit;
 	unsigned long  st_size;
 	unsigned long  st_atime;
 	unsigned long  st_mtime;