diff options
| author | Thomas Hellstrom <thomas-at-tungstengraphics-dot-com> | 2006-12-19 23:45:59 +0100 |
|---|---|---|
| committer | Thomas Hellstrom <thomas-at-tungstengraphics-dot-com> | 2006-12-19 23:45:59 +0100 |
| commit | 3b8e6ccd2573a027aa30c10d08253de1756540c2 (patch) | |
| tree | 562ac4490c8521d6be623c8170b7c474bd55b907 /linux-core | |
| parent | 72b5d1507a7e9c18fc0141c13819ea01c0813924 (diff) | |
Security fix. Zero pages before they are handed to user space.
TTM pages were not cleared when allocated and handed to user space.
Sensitive information may leak.
Diffstat (limited to 'linux-core')
| -rw-r--r-- | linux-core/drm_compat.c | 2 | ||||
| -rw-r--r-- | linux-core/drm_ttm.c | 2 | ||||
| -rw-r--r-- | linux-core/drm_vm.c | 2 |
3 files changed, 6 insertions, 0 deletions
diff --git a/linux-core/drm_compat.c b/linux-core/drm_compat.c index b466f8bd..cde77ea7 100644 --- a/linux-core/drm_compat.c +++ b/linux-core/drm_compat.c @@ -259,6 +259,8 @@ struct page *drm_vm_ttm_nopage(struct vm_area_struct *vma, } ++bm->cur_pages; SetPageLocked(page); + clear_page(kmap(page)); + kunmap(page); } get_page(page); diff --git a/linux-core/drm_ttm.c b/linux-core/drm_ttm.c index 931972af..c32dfcf9 100644 --- a/linux-core/drm_ttm.c +++ b/linux-core/drm_ttm.c @@ -235,6 +235,8 @@ static int drm_ttm_populate(drm_ttm_t * ttm) #else SetPageReserved(page); #endif + clear_page(kmap(page)); + kunmap(page); ttm->pages[i] = page; ++bm->cur_pages; } diff --git a/linux-core/drm_vm.c b/linux-core/drm_vm.c index 2bf408eb..f36218e9 100644 --- a/linux-core/drm_vm.c +++ b/linux-core/drm_vm.c @@ -220,6 +220,8 @@ struct page *drm_vm_ttm_fault(struct vm_area_struct *vma, #else SetPageReserved(page); #endif + clear_page(kmap(page)); + kunmap(page); } if (ttm->page_flags & DRM_TTM_PAGE_UNCACHED) { |