From: Shaohua Li <shaohua.li@intel.com>
Date: Mon, 20 Apr 2009 00:08:35 +0000 (+1000)
Subject: agp: zero pages before sending to userspace
X-Git-Tag: v2.6.27.22~21
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=28adca7b3ca1cfd63b01e1a8da30a234282aa05c;p=thirdparty%2Fkernel%2Fstable.git

agp: zero pages before sending to userspace

upstream commit: 59de2bebabc5027f93df999d59cc65df591c3e6e

CVE-2009-1192

AGP pages might be mapped into userspace finally, so the pages should be
set to zero before userspace can use it. Otherwise there is potential
information leakage.

Signed-off-by: Shaohua Li <shaohua.li@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 118dbde25dc71..8cf3dca17dd18 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -1207,7 +1207,7 @@ void *agp_generic_alloc_page(struct agp_bridge_data *bridge)
 {
 	struct page * page;
 
-	page = alloc_page(GFP_KERNEL | GFP_DMA32);
+	page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO);
 	if (page == NULL)
 		return NULL;