drm/tegra: Don't leak kernel pointer to userspace
authorThierry Reding <treding@nvidia.com>
Thu, 9 Mar 2017 19:04:55 +0000 (20:04 +0100)
committerThierry Reding <treding@nvidia.com>
Wed, 5 Apr 2017 16:11:45 +0000 (18:11 +0200)
commitbdd2f9cd10eb842be96418cc226bc33744d358b0
tree2c7218a91db7e0fc7327fcd60be1417529f8cc96
parent347ad49d35a1c65d509e7ef5b0760e97ede41ec2
drm/tegra: Don't leak kernel pointer to userspace

Each open file descriptor can have any number of contexts associated
with it. To differentiate between these contexts a unique ID is required
and back when these userspace interfaces were introduced, in commit
d43f81cbaf43 ("drm/tegra: Add gr2d device"), the pointer to the context
structure was deemed adequate. However, this leaks information about
kernel internal memory to userspace, which can potentially be exploited.

Switch the context parameter to be allocated from an IDR, which has the
added benefit of providing an easy way to look up a context from its ID.

Signed-off-by: Thierry Reding <treding@nvidia.com>
drivers/gpu/drm/tegra/drm.c
drivers/gpu/drm/tegra/drm.h