summaryrefslogtreecommitdiff
path: root/linux-core
diff options
context:
space:
mode:
authorThomas Hellstrom <thomas-at-tungstengraphics-dot-com>2006-12-19 23:45:59 +0100
committerThomas Hellstrom <thomas-at-tungstengraphics-dot-com>2006-12-19 23:45:59 +0100
commit3b8e6ccd2573a027aa30c10d08253de1756540c2 (patch)
tree562ac4490c8521d6be623c8170b7c474bd55b907 /linux-core
parent72b5d1507a7e9c18fc0141c13819ea01c0813924 (diff)
Security fix. Zero pages before they are handed to user space.
TTM pages were not cleared when allocated and handed to user space. Sensitive information may leak.
Diffstat (limited to 'linux-core')
-rw-r--r--linux-core/drm_compat.c2
-rw-r--r--linux-core/drm_ttm.c2
-rw-r--r--linux-core/drm_vm.c2
3 files changed, 6 insertions, 0 deletions
diff --git a/linux-core/drm_compat.c b/linux-core/drm_compat.c
index b466f8bd..cde77ea7 100644
--- a/linux-core/drm_compat.c
+++ b/linux-core/drm_compat.c
@@ -259,6 +259,8 @@ struct page *drm_vm_ttm_nopage(struct vm_area_struct *vma,
}
++bm->cur_pages;
SetPageLocked(page);
+ clear_page(kmap(page));
+ kunmap(page);
}
get_page(page);
diff --git a/linux-core/drm_ttm.c b/linux-core/drm_ttm.c
index 931972af..c32dfcf9 100644
--- a/linux-core/drm_ttm.c
+++ b/linux-core/drm_ttm.c
@@ -235,6 +235,8 @@ static int drm_ttm_populate(drm_ttm_t * ttm)
#else
SetPageReserved(page);
#endif
+ clear_page(kmap(page));
+ kunmap(page);
ttm->pages[i] = page;
++bm->cur_pages;
}
diff --git a/linux-core/drm_vm.c b/linux-core/drm_vm.c
index 2bf408eb..f36218e9 100644
--- a/linux-core/drm_vm.c
+++ b/linux-core/drm_vm.c
@@ -220,6 +220,8 @@ struct page *drm_vm_ttm_fault(struct vm_area_struct *vma,
#else
SetPageReserved(page);
#endif
+ clear_page(kmap(page));
+ kunmap(page);
}
if (ttm->page_flags & DRM_TTM_PAGE_UNCACHED) {