From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: [patch] vmwgfx: information leak in vmw_execbuf_copy_fence_user() Date: Tue, 18 Oct 2011 09:10:12 +0300 Message-ID: <20111018061012.GE27732@elgon.mountain> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from acsinet15.oracle.com (acsinet15.oracle.com [141.146.126.227]) by gabe.freedesktop.org (Postfix) with ESMTP id 127869E7CA for ; Mon, 17 Oct 2011 23:10:19 -0700 (PDT) Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org Errors-To: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org To: David Airlie Cc: Thomas Hellstrom , kernel-janitors@vger.kernel.org, Vasiliy Kulikov , dri-devel@lists.freedesktop.org, Jerome Glisse , Dave Airlie List-Id: dri-devel@lists.freedesktop.org If ret is non-zero then we don't initialize the struct which leaks stack information to user space. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index d4a1d8b..28e1c35 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -1070,6 +1070,8 @@ vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv, if (user_fence_rep == NULL) return; + memset(&fence_rep, 0, sizeof(fence_rep)); + fence_rep.error = ret; if (ret == 0) { BUG_ON(fence == NULL);