]> git.baikalelectronics.ru Git - kernel.git/commit
drm/tegra: Don't leak kernel pointer to userspace
authorThierry Reding <treding@nvidia.com>
Thu, 9 Mar 2017 19:04:55 +0000 (20:04 +0100)
committerThierry Reding <treding@nvidia.com>
Wed, 5 Apr 2017 16:11:45 +0000 (18:11 +0200)
commit6a8442beab2b581202ca7454f69f2ed92753c78b
tree2c7218a91db7e0fc7327fcd60be1417529f8cc96
parentaf815af8daddd8dd2af773709b332a03ee70675f
drm/tegra: Don't leak kernel pointer to userspace

Each open file descriptor can have any number of contexts associated
with it. To differentiate between these contexts a unique ID is required
and back when these userspace interfaces were introduced, in commit
5a414a1988fb ("drm/tegra: Add gr2d device"), the pointer to the context
structure was deemed adequate. However, this leaks information about
kernel internal memory to userspace, which can potentially be exploited.

Switch the context parameter to be allocated from an IDR, which has the
added benefit of providing an easy way to look up a context from its ID.

Signed-off-by: Thierry Reding <treding@nvidia.com>
drivers/gpu/drm/tegra/drm.c
drivers/gpu/drm/tegra/drm.h