Security fix in comedi_buf_alloc() for non-DMA data buffers. Allocate each

page using get_zeroed_page() instead of __get_free_page() to avoid exposing
random memory contents to user space if the buffer is mmap'ed.

diff --git a/comedi/drivers.c b/comedi/drivers.c
index 5b9152e08a82e84e8a002acfda329c28dfd4f629..15b396c868871c562d42f1d9ba47ca7e4c602bf5 100644 (file)
--- a/comedi/drivers.c
+++ b/comedi/drivers.c
@@ -483,7 +483,7 @@ int comedi_buf_alloc(comedi_device *dev, comedi_subdevice *s,
                                        async->buf_page_list[i].virt_addr = dma_alloc_coherent(dev->hw_dev,
                                                PAGE_SIZE, &async->buf_page_list[i].dma_addr, GFP_KERNEL | __GFP_COMP);
                                }else{
-                                       async->buf_page_list[i].virt_addr = (void*)__get_free_page(GFP_KERNEL);
+                                       async->buf_page_list[i].virt_addr = (void*)get_zeroed_page(GFP_KERNEL);
                                }
                                if(async->buf_page_list[i].virt_addr == NULL){
                                        break;