path: root/drivers/gpu
diff options
authorDave Airlie <airlied@redhat.com>2010-08-17 14:46:00 +1000
committerDave Airlie <airlied@redhat.com>2010-08-17 14:51:45 +1000
commitb9f0aee83335db1f3915f4e42a5e21b351740afd (patch)
tree3328b6503f7852868f642263dfa8a3decc487a1e /drivers/gpu
parent31ce4bfdfd10bf5db9bf85c92bbe0cf2edbdcad8 (diff)
drm: stop information leak of old kernel stack.
non-critical issue, CVE-2010-2803 Userspace controls the amount of memory to be allocate, so it can get the ioctl to allocate more memory than the kernel uses, and get access to kernel stack. This can only be done for processes authenticated to the X server for DRI access, and if the user has DRI access. Fix is to just memset the data to 0 if the user doesn't copy into it in the first place. Reported-by: Kees Cook <kees@ubuntu.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu')
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 90288ec7c28..3644c94c0a1 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -477,7 +477,9 @@ long drm_ioctl(struct file *filp,
retcode = -EFAULT;
goto err_i1;
- }
+ } else
+ memset(kdata, 0, _IOC_SIZE(cmd));
if (ioctl->flags & DRM_UNLOCKED)
retcode = func(dev, kdata, file_priv);
else {