From d5e8ab13ff5399531eb1927dcd4535aeeed18c94 Mon Sep 17 00:00:00 2001 From: Thomas Hellstrom Date: Wed, 10 Aug 2005 19:46:46 +0000 Subject: Security fix on via: Checking that the specified context belongs to the caller on fb / agp memory alloc and free. Otherwise malicious clients can register allocations on other clients or free memory used by other clients which will lead to severe memory manager inconsistensies. --- shared-core/via_mm.c | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'shared-core/via_mm.c') diff --git a/shared-core/via_mm.c b/shared-core/via_mm.c index 13921f3c..89d762f1 100644 --- a/shared-core/via_mm.c +++ b/shared-core/via_mm.c @@ -192,11 +192,16 @@ int via_final_context(struct drm_device *dev, int context) int via_mem_alloc(DRM_IOCTL_ARGS) { + drm_file_t *priv = filp->private_data; drm_via_mem_t mem; DRM_COPY_FROM_USER_IOCTL(mem, (drm_via_mem_t __user *) data, sizeof(mem)); + if (!drm_check_context(priv, mem.context)) { + return DRM_ERR(EINVAL); + } + switch (mem.type) { case VIDEO: if (via_fb_alloc(&mem) < 0) @@ -289,11 +294,16 @@ static int via_agp_alloc(drm_via_mem_t * mem) int via_mem_free(DRM_IOCTL_ARGS) { + drm_file_t *priv = filp->private_data; drm_via_mem_t mem; DRM_COPY_FROM_USER_IOCTL(mem, (drm_via_mem_t __user *) data, sizeof(mem)); + if (!drm_check_context(priv, mem.context)) { + return DRM_ERR(EINVAL); + } + switch (mem.type) { case VIDEO: -- cgit v1.2.3