drm: stop information leak of old kernel stack.
authorDave Airlie <airlied@redhat.com>
Tue, 17 Aug 2010 04:46:00 +0000 (14:46 +1000)
committerGreg Kroah-Hartman <gregkh@suse.de>
Thu, 26 Aug 2010 23:40:13 +0000 (16:40 -0700)
commit2afa902362e67ff39a9d0f5d3523ded05a1b7c70
tree23f8a79255445adec1e03e31190729bc05be7864
parent346767e3c92722f478fc80d863d6e2d1c6fd396e
drm: stop information leak of old kernel stack.

commit b9f0aee83335db1f3915f4e42a5e21b351740afd upstream.

non-critical issue, CVE-2010-2803

Userspace controls the amount of memory to be allocate, so it can
get the ioctl to allocate more memory than the kernel uses, and get
access to kernel stack. This can only be done for processes authenticated
to the X server for DRI access, and if the user has DRI access.

Fix is to just memset the data to 0 if the user doesn't copy into
it in the first place.

Reported-by: Kees Cook <kees@ubuntu.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/gpu/drm/drm_drv.c