From 1d930fc75b99a89fc77d35d8f95f2877cfd5d7f0 Mon Sep 17 00:00:00 2001 From: Matthias Hopf Date: Sat, 25 Oct 2008 12:11:44 -0400 Subject: drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831) Olaf Kirch noticed that the i915_set_status_page() function of the i915 kernel driver calls ioremap with an address offset that is supplied by userspace via ioctl. The function zeroes the mapped memory via memset and tells the hardware about the address. Turns out that access to that ioctl is not restricted to root so users could probably exploit that to do nasty things. We haven't tried to write actual exploit code though. It only affects the Intel G33 series and newer. --- shared-core/i915_dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'shared-core/i915_dma.c') diff --git a/shared-core/i915_dma.c b/shared-core/i915_dma.c index 619e6ac2..93bfcba5 100644 --- a/shared-core/i915_dma.c +++ b/shared-core/i915_dma.c @@ -1225,7 +1225,7 @@ struct drm_ioctl_desc i915_ioctls[] = { DRM_IOCTL_DEF(DRM_I915_GET_VBLANK_PIPE, i915_vblank_pipe_get, DRM_AUTH ), DRM_IOCTL_DEF(DRM_I915_VBLANK_SWAP, i915_vblank_swap, DRM_AUTH), DRM_IOCTL_DEF(DRM_I915_MMIO, i915_mmio, DRM_AUTH), - DRM_IOCTL_DEF(DRM_I915_HWS_ADDR, i915_set_status_page, DRM_AUTH), + DRM_IOCTL_DEF(DRM_I915_HWS_ADDR, i915_set_status_page, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY), #ifdef I915_HAVE_BUFFER DRM_IOCTL_DEF(DRM_I915_EXECBUFFER, i915_execbuffer, DRM_AUTH), #endif -- cgit v1.2.3 From 145d2d610b90b6129bbbebd1e1f8c71f9147cbde Mon Sep 17 00:00:00 2001 From: Robert Noland Date: Mon, 27 Oct 2008 14:39:05 -0400 Subject: i915: Since FreeBSD doesn't have gem support yet, don't advertise it. This allows us to not crash X when using newer Intel ddx drivers. --- shared-core/i915_dma.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'shared-core/i915_dma.c') diff --git a/shared-core/i915_dma.c b/shared-core/i915_dma.c index 93bfcba5..29a0a1aa 100644 --- a/shared-core/i915_dma.c +++ b/shared-core/i915_dma.c @@ -911,7 +911,11 @@ static int i915_getparam(struct drm_device *dev, void *data, value = dev->pci_device; break; case I915_PARAM_HAS_GEM: +#ifdef I915_HAVE_GEM value = 1; +#else + value = 0; +#endif break; default: DRM_ERROR("Unknown parameter %d\n", param->param); -- cgit v1.2.3