armbian/linux
0
0
Fork 0
mirror of https://github.com/armbian/linux.git synced 2026-01-06 10:13:00 -08:00
Code Issues Packages Projects Releases Wiki Activity

drm: stop information leak of old kernel stack.

Browse Source 
commit b9f0aee833 upstream.

non-critical issue, CVE-2010-2803

Userspace controls the amount of memory to be allocate, so it can
get the ioctl to allocate more memory than the kernel uses, and get
access to kernel stack. This can only be done for processes authenticated
to the X server for DRI access, and if the user has DRI access.

Fix is to just memset the data to 0 if the user doesn't copy into
it in the first place.

Reported-by: Kees Cook <kees@ubuntu.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Dave Airlie
2010-08-17 14:46:00 +10:00
committed by Greg Kroah-Hartman
parent cbe351a4e7
commit 2bf659d8fe
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/gpu/drm/drm_drv.c
View File

@@ -470,7 +470,9 @@ int drm_ioctl(struct inode *inode, struct file *filp,
retcode = -EFAULT;
goto err_i1;
}
}
} else
memset(kdata, 0, _IOC_SIZE(cmd));
retcode = func(dev, kdata, file_priv);
if (cmd & IOC_OUT) {