Re: [PATCH 6/8] char: synclink: fix information leak to userland

[Vasiliy Kulikov <segooon@gmail.com>]

On Sun, Oct 17, 2010 at 19:46 +0200, Jiri Slaby wrote:
> On 10/17/2010 05:38 PM, Vasiliy Kulikov wrote:
> > On Sun, Oct 17, 2010 at 17:34 +0200, Jiri Slaby wrote:
> >> On 10/17/2010 04:41 PM, Vasiliy Kulikov wrote:
> >>> Structure new_line is copied to userland with some padding fields unitialized.
> >>> It leads to leaking of stack memory.
> >>
> >> I think your tool has a bug. I must admit I fail to see the padding
> >> which would cause leaks. Could you elaborate?
> > 
> > I didn't use any tool except "grep copy_to_user" :)
> > 
> >     typedef struct { 
> >         unsigned int clock_rate; /* bits per second */
> >         unsigned int clock_type; /* internal, external, TX-internal etc. */
> >         unsigned short loopback;
> >     } sync_serial_settings;          /* V.35, V.24, X.21 */
> > 
> > On x86_64 sizeof(sync_serial_settings) = 4 + 4 + 2 + 2 = 12.
> > The last 2 is padding.
> 
> Ah, good to know that even end of structures is padded.

The rule here is that array of struct has no padding between struct
elements.  So, struct has padding in the end to have good alignment of
the first field of the next array element.

Thanks,

-- 
Vasiliy