From 3b8e6ccd2573a027aa30c10d08253de1756540c2 Mon Sep 17 00:00:00 2001
From: Thomas Hellstrom <thomas-at-tungstengraphics-dot-com>
Date: Tue, 19 Dec 2006 23:45:59 +0100
Subject: Security fix. Zero pages before they are handed to user space.

TTM pages were not cleared when allocated and handed to user space.
Sensitive information may leak.
---
 linux-core/drm_compat.c | 2 ++
 linux-core/drm_ttm.c    | 2 ++
 linux-core/drm_vm.c     | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/linux-core/drm_compat.c b/linux-core/drm_compat.c
index b466f8bd..cde77ea7 100644
--- a/linux-core/drm_compat.c
+++ b/linux-core/drm_compat.c
@@ -259,6 +259,8 @@ struct page *drm_vm_ttm_nopage(struct vm_area_struct *vma,
 		}
 		++bm->cur_pages;
 		SetPageLocked(page);
+		clear_page(kmap(page));
+		kunmap(page);
 	}
 
 	get_page(page);
diff --git a/linux-core/drm_ttm.c b/linux-core/drm_ttm.c
index 931972af..c32dfcf9 100644
--- a/linux-core/drm_ttm.c
+++ b/linux-core/drm_ttm.c
@@ -235,6 +235,8 @@ static int drm_ttm_populate(drm_ttm_t * ttm)
 #else
 			SetPageReserved(page);
 #endif
+			clear_page(kmap(page));
+			kunmap(page);
 			ttm->pages[i] = page;
 			++bm->cur_pages;
 		}
diff --git a/linux-core/drm_vm.c b/linux-core/drm_vm.c
index 2bf408eb..f36218e9 100644
--- a/linux-core/drm_vm.c
+++ b/linux-core/drm_vm.c
@@ -220,6 +220,8 @@ struct page *drm_vm_ttm_fault(struct vm_area_struct *vma,
 #else
 		SetPageReserved(page);
 #endif
+		clear_page(kmap(page));
+		kunmap(page);
 	}
 
 	if (ttm->page_flags & DRM_TTM_PAGE_UNCACHED) {
-- 
cgit v1.2.3