aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDave Airlie <airlied@redhat.com>2010-08-17 14:46:00 +1000
committerGreg Kroah-Hartman <gregkh@suse.de>2010-08-26 16:44:02 -0700
commite72ac0859381d39b8647754f3b03eee878dd1c06 (patch)
treeee95e55a200181bed467cd2f14dbc7872d950706
parent83573f5bcad91bd12ae3f7e8a429d8696c7dc663 (diff)
drm: stop information leak of old kernel stack.
commit b9f0aee83335db1f3915f4e42a5e21b351740afd upstream. non-critical issue, CVE-2010-2803 Userspace controls the amount of memory to be allocate, so it can get the ioctl to allocate more memory than the kernel uses, and get access to kernel stack. This can only be done for processes authenticated to the X server for DRI access, and if the user has DRI access. Fix is to just memset the data to 0 if the user doesn't copy into it in the first place. Reported-by: Kees Cook <kees@ubuntu.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--drivers/gpu/drm/drm_drv.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 4a66201edae..c9736ed5d5b 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -502,7 +502,9 @@ long drm_ioctl(struct file *filp,
retcode = -EFAULT;
goto err_i1;
}
- }
+ } else
+ memset(kdata, 0, _IOC_SIZE(cmd));
+
if (ioctl->flags & DRM_UNLOCKED)
retcode = func(dev, kdata, file_priv);
else {