diff options
| author | Thomas Hellstrom <thomas-at-tungstengraphics-dot-com> | 2006-12-19 23:45:59 +0100 |
|---|---|---|
| committer | Thomas Hellstrom <thomas-at-tungstengraphics-dot-com> | 2006-12-19 23:45:59 +0100 |
| commit | 3b8e6ccd2573a027aa30c10d08253de1756540c2 (patch) | |
| tree | 562ac4490c8521d6be623c8170b7c474bd55b907 | |
| parent | 72b5d1507a7e9c18fc0141c13819ea01c0813924 (diff) | |
Security fix. Zero pages before they are handed to user space.
TTM pages were not cleared when allocated and handed to user space.
Sensitive information may leak.
| -rw-r--r-- | linux-core/drm_compat.c | 2 | ||||
| -rw-r--r-- | linux-core/drm_ttm.c | 2 | ||||
| -rw-r--r-- | linux-core/drm_vm.c | 2 |
3 files changed, 6 insertions, 0 deletions
diff --git a/linux-core/drm_compat.c b/linux-core/drm_compat.c index b466f8bd..cde77ea7 100644 --- a/linux-core/drm_compat.c +++ b/linux-core/drm_compat.c @@ -259,6 +259,8 @@ struct page *drm_vm_ttm_nopage(struct vm_area_struct *vma, } ++bm->cur_pages; SetPageLocked(page); + clear_page(kmap(page)); + kunmap(page); } get_page(page); diff --git a/linux-core/drm_ttm.c b/linux-core/drm_ttm.c index 931972af..c32dfcf9 100644 --- a/linux-core/drm_ttm.c +++ b/linux-core/drm_ttm.c @@ -235,6 +235,8 @@ static int drm_ttm_populate(drm_ttm_t * ttm) #else SetPageReserved(page); #endif + clear_page(kmap(page)); + kunmap(page); ttm->pages[i] = page; ++bm->cur_pages; } diff --git a/linux-core/drm_vm.c b/linux-core/drm_vm.c index 2bf408eb..f36218e9 100644 --- a/linux-core/drm_vm.c +++ b/linux-core/drm_vm.c @@ -220,6 +220,8 @@ struct page *drm_vm_ttm_fault(struct vm_area_struct *vma, #else SetPageReserved(page); #endif + clear_page(kmap(page)); + kunmap(page); } if (ttm->page_flags & DRM_TTM_PAGE_UNCACHED) { |