Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dccb2a95 authored by Kulikov Vasiliy's avatar Kulikov Vasiliy Committed by Dave Airlie
Browse files

drm: vmwgfx: fix information leak to userland 



Structure drm_vmw_fence_rep is copied to userland with field "pad64"
uninitialized.  It leads to leaking of contents of kernel stack memory.

Signed-off-by: default avatarVasiliy Kulikov <segooon@gmail.com>
Reviewed-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent ec3789cc

drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -691,6 +691,7 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data, 




	fence_rep.error = ret;

	fence_rep.error = ret;

	fence_rep.fence_seq = (uint64_t) sequence;

	fence_rep.fence_seq = (uint64_t) sequence;

	fence_rep.pad64 = 0;





	user_fence_rep = (struct drm_vmw_fence_rep __user *)

	user_fence_rep = (struct drm_vmw_fence_rep __user *)

	    (unsigned long)arg->fence_rep;

	    (unsigned long)arg->fence_rep;