Author: emaste
Date: Fri Mar 23 02:38:31 2018
New Revision: 331412
URL: https://svnweb.freebsd.org/changeset/base/331412
Log:
MFC r331333: Fix kernel memory disclosure in drm_infobufs
drm_infobufs() has a structure on the stack, fills it out and copies it
to userland. There are 2 elements in the struct that are not filled out
and left uninitialized. This will leak uninitialized kernel stack data
to userland.
Submitted by: Domagoj Stolfa <ds...@cam.ac.uk>
Reported by: Ilja Van Sprundel <ivansprun...@ioactive.com>
Security: Kernel memory disclosure (798)
Modified:
stable/10/sys/dev/drm/drm_bufs.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/sys/dev/drm/drm_bufs.c
==============================================================================
--- stable/10/sys/dev/drm/drm_bufs.c Fri Mar 23 02:37:08 2018
(r331411)
+++ stable/10/sys/dev/drm/drm_bufs.c Fri Mar 23 02:38:31 2018
(r331412)
@@ -935,6 +935,7 @@ int drm_infobufs(struct drm_device *dev, void *data, s
if (dma->bufs[i].buf_count) {
struct drm_buf_desc from;
+ memset(&from, 0, sizeof(from));
from.count = dma->bufs[i].buf_count;
from.size = dma->bufs[i].buf_size;
from.low_mark = dma->bufs[i].freelist.low_mark;
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"
