Skip to contentSkip to conversation

gpu: drm: vmwgfx: fix information leak to userland

PATCH In review Vasiliy Kulikov 2 participants 2 messages Nov 6, 2010 – Nov 8, 2010

Subsystems (4)
DRM drivers DRM misc Kernel janitors DRM driver for VMware virtual GPU
lore
Share & tools
lore

Vasiliy Kulikov

author
#0 lore raw

PATCH 1/1 gpu: drm: vmwgfx: fix information leak to userland

Structure drm_vmw_fence_rep is copied to userland with field "pad64" uninitialized. It leads to leaking of contents of kernel stack memory.

Signed-off-by Vasiliy Kulikov <[email protected]>

---
Compile tested.

 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +1 -0
index 51d9f9f..76954e3 100644
@@ -691,6 +691,7 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
 
 	fence_rep.error = ret;
 	fence_rep.fence_seq = (uint64_t) sequence;
+	fence_rep.pad64 = 0;
 
 	user_fence_rep = (struct drm_vmw_fence_rep __user *)
 	    (unsigned long)arg->fence_rep;
Signature · 1 line
1.7.0.4
Reviewed-by on v1 1/1
#1 lore raw
Quoted 16 lines · Vasiliy Kulikov

Structure drm_vmw_fence_rep is copied to userland with field "pad64" uninitialized. It leads to leaking of contents of kernel stack memory.

Signed-off-by Vasiliy Kulikov<[email protected]>

---
Compile tested.

  drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c |    1 +
  1 files changed, 1 insertions(+), 0 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +0 -0
index 51d9f9f..76954e3 100644

drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c int vmw_execbuf_ioctl(struct drm_device *dev, void *data, · line 697

Quoted 7 lines
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +1 -0
@@ -691,6 +691,7 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
 
  	fence_rep.error = ret;
  	fence_rep.fence_seq = (uint64_t) sequence;
+	fence_rep.pad64 = 0;
 
  	user_fence_rep = (struct drm_vmw_fence_rep __user *)
  	    (unsigned long)arg->fence_rep;
Reviewed-by Thomas Hellstrom <[email protected]>