]> git.baikalelectronics.ru Git - kernel.git/commit
drm/tegra: Don't leak kernel pointer to userspace
authorThierry Reding <treding@nvidia.com>
Thu, 9 Mar 2017 19:04:55 +0000 (20:04 +0100)
committerThierry Reding <treding@nvidia.com>
Wed, 5 Apr 2017 16:11:45 +0000 (18:11 +0200)
commit66ed2d4e72ebda12b4841fe79bd77f0283f2a670
tree2c7218a91db7e0fc7327fcd60be1417529f8cc96
parentf2eeb83c03738a32345e0cfad7ceba5aa0ef1124
drm/tegra: Don't leak kernel pointer to userspace

Each open file descriptor can have any number of contexts associated
with it. To differentiate between these contexts a unique ID is required
and back when these userspace interfaces were introduced, in commit
1ff97643a4eb ("drm/tegra: Add gr2d device"), the pointer to the context
structure was deemed adequate. However, this leaks information about
kernel internal memory to userspace, which can potentially be exploited.

Switch the context parameter to be allocated from an IDR, which has the
added benefit of providing an easy way to look up a context from its ID.

Signed-off-by: Thierry Reding <treding@nvidia.com>
drivers/gpu/drm/tegra/drm.c
drivers/gpu/drm/tegra/drm.h