From 3b8e6ccd2573a027aa30c10d08253de1756540c2 Mon Sep 17 00:00:00 2001
From: Thomas Hellstrom <thomas-at-tungstengraphics-dot-com>
Date: Tue, 19 Dec 2006 23:45:59 +0100
Subject: Security fix. Zero pages before they are handed to user space.
TTM pages were not cleared when allocated and handed to user space.
Sensitive information may leak.
---
linux-core/drm_compat.c | 2 ++
linux-core/drm_ttm.c | 2 ++
linux-core/drm_vm.c | 2 ++
3 files changed, 6 insertions(+)
(limited to 'linux-core')
diff --git a/linux-core/drm_compat.c b/linux-core/drm_compat.c
index b466f8bd..cde77ea7 100644
--- a/linux-core/drm_compat.c
+++ b/linux-core/drm_compat.c
@@ -259,6 +259,8 @@ struct page *drm_vm_ttm_nopage(struct vm_area_struct *vma,
}
++bm->cur_pages;
SetPageLocked(page);
+ clear_page(kmap(page));
+ kunmap(page);
}
get_page(page);
diff --git a/linux-core/drm_ttm.c b/linux-core/drm_ttm.c
index 931972af..c32dfcf9 100644
--- a/linux-core/drm_ttm.c
+++ b/linux-core/drm_ttm.c
@@ -235,6 +235,8 @@ static int drm_ttm_populate(drm_ttm_t * ttm)
#else
SetPageReserved(page);
#endif
+ clear_page(kmap(page));
+ kunmap(page);
ttm->pages[i] = page;
++bm->cur_pages;
}
diff --git a/linux-core/drm_vm.c b/linux-core/drm_vm.c
index 2bf408eb..f36218e9 100644
--- a/linux-core/drm_vm.c
+++ b/linux-core/drm_vm.c
@@ -220,6 +220,8 @@ struct page *drm_vm_ttm_fault(struct vm_area_struct *vma,
#else
SetPageReserved(page);
#endif
+ clear_page(kmap(page));
+ kunmap(page);
}
if (ttm->page_flags & DRM_TTM_PAGE_UNCACHED) {
--
cgit v1.2.3