Ed Maste b8728e7d36 MFC r331333: Fix kernel memory disclosure in drm_infobufs ...

drm_infobufs() has a structure on the stack, fills it out and copies it
to userland.  There are 2 elements in the struct that are not filled out
and left uninitialized.  This will leak uninitialized kernel stack data
to userland.

Submitted by:	Domagoj Stolfa <[email protected]>
Reported by:	Ilja Van Sprundel <[email protected]>
Security:	Kernel memory disclosure (798)

2018-03-23 02:37:08 +00:00

..

ati_pcigart.c

…

drm_agpsupport.c

…

drm_atomic.h

…

drm_auth.c

…

drm_bufs.c

MFC r331333: Fix kernel memory disclosure in drm_infobufs

2018-03-23 02:37:08 +00:00

drm_context.c

…

drm_dma.c

…

drm_drawable.c

…

drm_drv.c

…

drm_fops.c

…

drm_hashtab.c

…

drm_hashtab.h

…

drm_internal.h

…

drm_ioctl.c

…

drm_irq.c

MFC r331339: Correct signedness bug in drm_modeset_ctl

2018-03-23 02:33:30 +00:00

drm_linux_list.h

…

drm_lock.c

…

drm_memory.c

…

drm_mm.c

…

drm_mm.h

…

drm_pci.c

…

drm_pciids.h

…

drm_sarea.h

…

drm_scatter.c

MFC r315281:

2017-03-28 06:07:59 +00:00

drm_sman.c

…

drm_sman.h

…

drm_sysctl.c

…

drm_vm.c

sys/dev: minor spelling fixes.

2016-05-03 03:41:25 +00:00

drm.h

sys/dev: minor spelling fixes.

2016-05-03 03:41:25 +00:00

drmP.h

MFC r317055,r317056 (glebius): Include sys/vmmeter.h as included

2018-03-15 19:08:33 +00:00

i915_dma.c

…

i915_drm.h

…

i915_drv.c

…

i915_drv.h

sys/dev: minor spelling fixes.

2016-05-03 03:41:25 +00:00

i915_irq.c

…

i915_mem.c

…

i915_reg.h

…

i915_suspend.c

…

mach64_dma.c

…

mach64_drm.h

…

mach64_drv.c

…

mach64_drv.h

…

mach64_irq.c

…

mach64_state.c

sys/dev: minor spelling fixes.

2016-05-03 03:41:25 +00:00

mga_dma.c

sys/dev: minor spelling fixes.

2016-05-03 03:41:25 +00:00

mga_drm.h

sys/dev: minor spelling fixes.

2016-05-03 03:41:25 +00:00

mga_drv.c

…

mga_drv.h

…

mga_irq.c

…

mga_state.c

MFC r327231,r327232:

2018-03-05 06:59:30 +00:00

mga_ucode.h

…

mga_warp.c

…

r128_cce.c

…

r128_drm.h

…

r128_drv.c

…

r128_drv.h

…

r128_irq.c

…

r128_state.c

…

r300_cmdbuf.c

…

r300_reg.h

…

r600_blit.c

…

r600_cp.c

…

r600_microcode.h

…

radeon_cp.c

sys/dev: minor spelling fixes.

2016-05-03 03:41:25 +00:00

radeon_cs.c

…

radeon_drm.h

sys/dev: minor spelling fixes.

2016-05-03 03:41:25 +00:00

radeon_drv.c

…

radeon_drv.h

sys/dev: minor spelling fixes.

2016-05-03 03:41:25 +00:00

radeon_irq.c

…

radeon_mem.c

…

radeon_microcode.h

…

radeon_state.c

sys/dev: minor spelling fixes.

2016-05-03 03:41:25 +00:00

savage_bci.c

sys/dev: minor spelling fixes.

2016-05-03 03:41:25 +00:00

savage_drm.h

sys/dev: minor spelling fixes.

2016-05-03 03:41:25 +00:00

savage_drv.c

…

savage_drv.h

…

savage_state.c

…

sis_drm.h

…

sis_drv.c

…

sis_drv.h

…

sis_ds.c

…

sis_ds.h

…

sis_mm.c

…

tdfx_drv.c

…

tdfx_drv.h

…

via_3d_reg.h

…

via_dma.c

…

via_dmablit.c

…

via_dmablit.h

…

via_drm.h

…

via_drv.c

…

via_drv.h

…

via_irq.c

…

via_map.c

…

via_mm.c

…

via_verifier.c

…

via_verifier.h

…

via_video.c

…