| From 0702b646e5bdc16af64ef6f663e5275a02bf40cd Mon Sep 17 00:00:00 2001 |
| From: Shaohua Li <shaohua.li@intel.com> |
| Date: Mon, 20 Apr 2009 10:08:35 +1000 |
| Subject: agp: zero pages before sending to userspace |
| |
| From: Shaohua Li <shaohua.li@intel.com> |
| |
| upstream commit: 59de2bebabc5027f93df999d59cc65df591c3e6e |
| |
| CVE-2009-1192 |
| |
| AGP pages might be mapped into userspace finally, so the pages should be |
| set to zero before userspace can use it. Otherwise there is potential |
| information leakage. |
| |
| Signed-off-by: Shaohua Li <shaohua.li@intel.com> |
| Signed-off-by: Dave Airlie <airlied@redhat.com> |
| Signed-off-by: Chris Wright <chrisw@sous-sol.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| --- |
| drivers/char/agp/generic.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/char/agp/generic.c |
| +++ b/drivers/char/agp/generic.c |
| @@ -1226,7 +1226,7 @@ int agp_generic_alloc_pages(struct agp_b |
| int i, ret = -ENOMEM; |
| |
| for (i = 0; i < num_pages; i++) { |
| - page = alloc_page(GFP_KERNEL | GFP_DMA32); |
| + page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO); |
| /* agp_free_memory() needs gart address */ |
| if (page == NULL) |
| goto out; |
| @@ -1257,7 +1257,7 @@ void *agp_generic_alloc_page(struct agp_ |
| { |
| struct page * page; |
| |
| - page = alloc_page(GFP_KERNEL | GFP_DMA32); |
| + page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO); |
| if (page == NULL) |
| return NULL; |
| |