From 3b8e6ccd2573a027aa30c10d08253de1756540c2 Mon Sep 17 00:00:00 2001 From: Thomas Hellstrom Date: Tue, 19 Dec 2006 23:45:59 +0100 Subject: Security fix. Zero pages before they are handed to user space. TTM pages were not cleared when allocated and handed to user space. Sensitive information may leak. --- linux-core/drm_ttm.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'linux-core/drm_ttm.c') diff --git a/linux-core/drm_ttm.c b/linux-core/drm_ttm.c index 931972af..c32dfcf9 100644 --- a/linux-core/drm_ttm.c +++ b/linux-core/drm_ttm.c @@ -235,6 +235,8 @@ static int drm_ttm_populate(drm_ttm_t * ttm) #else SetPageReserved(page); #endif + clear_page(kmap(page)); + kunmap(page); ttm->pages[i] = page; ++bm->cur_pages; } -- cgit v1.2.3 From 975136d6e5adc6b6a03719499cf39fbd3f67dc90 Mon Sep 17 00:00:00 2001 From: Thomas Hellstrom Date: Wed, 27 Dec 2006 15:32:09 +0100 Subject: Proper allocation of AGP pages for ttms. --- linux-core/drm_ttm.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'linux-core/drm_ttm.c') diff --git a/linux-core/drm_ttm.c b/linux-core/drm_ttm.c index c32dfcf9..1c9b1cf7 100644 --- a/linux-core/drm_ttm.c +++ b/linux-core/drm_ttm.c @@ -193,7 +193,7 @@ int drm_destroy_ttm(drm_ttm_t * ttm) * End debugging. */ - drm_free_gatt_pages(*cur_page, 0); + __free_page(*cur_page); drm_free_memctl(PAGE_SIZE); --bm->cur_pages; } @@ -225,7 +225,7 @@ static int drm_ttm_populate(drm_ttm_t * ttm) if (drm_alloc_memctl(PAGE_SIZE)) { return -ENOMEM; } - page = drm_alloc_gatt_pages(0); + page = alloc_page(GFP_KERNEL | __GFP_ZERO | GFP_DMA32); if (!page) { drm_free_memctl(PAGE_SIZE); return -ENOMEM; @@ -235,8 +235,6 @@ static int drm_ttm_populate(drm_ttm_t * ttm) #else SetPageReserved(page); #endif - clear_page(kmap(page)); - kunmap(page); ttm->pages[i] = page; ++bm->cur_pages; } -- cgit v1.2.3