Vulnerability: The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.
Vulnerability ID: CVE-2017-9605
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2017-06-13
File: drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
Commit message: drm/vmwgfx: Make sure backup_handle is always valid

When vmw_gb_surface_define_ioctl() is called with an existing buffer,
we end up returning an uninitialized variable in the backup_handle.

The fix is to first initialize backup_handle to 0 just to be sure, and
second, when a user-provided buffer is found, we will use the
req->buffer_handle as the backup_handle.

Cc: <stable@vger.kernel.org>
Reported-by: Murray McAllister <murray.mcallister@insomniasec.com>
Signed-off-by: Sinclair Yeh <syeh@vmware.com>
Reviewed-by: Deepak Rawat <drawat@vmware.com>
Commit author: Sinclair Yeh

Vulnerable version (before fix):
 int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data, 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile; 	int ret; 	uint32_t size; 	uint32_t backup_handle;  	if (req->multisample_count != 0) 		return -EINVAL; int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data, 		ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle, 					     &res->backup, 					     &user_srf->backup_base); 		if (ret == 0 && res->backup->base.num_pages * PAGE_SIZE < 		    res->backup_size) { 			DRM_ERROR("Surface backup buffer is too small.\n"); 			vmw_dmabuf_unreference(&res->backup); 			ret = -EINVAL; 			goto out_unlock; 		} 	} else if (req->drm_surface_flags & drm_vmw_surface_flag_create_buffer) 		ret = vmw_user_dmabuf_alloc(dev_priv, tfile,

Fixed version (after fix):
 int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data, 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile; 	int ret; 	uint32_t size; 	uint32_t backup_handle = 0;  	if (req->multisample_count != 0) 		return -EINVAL; int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data, 		ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle, 					     &res->backup, 					     &user_srf->backup_base); 		if (ret == 0) { 			if (res->backup->base.num_pages * PAGE_SIZE < 			    res->backup_size) { 				DRM_ERROR("Surface backup buffer is too small.\n"); 				vmw_dmabuf_unreference(&res->backup); 				ret = -EINVAL; 				goto out_unlock; 			} else { 				backup_handle = req->buffer_handle; 			} 		} 	} else if (req->drm_surface_flags & drm_vmw_surface_flag_create_buffer) 		ret = vmw_user_dmabuf_alloc(dev_priv, tfile,

Patch:
patch: @@ -1274,7 +1274,7 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
 	int ret;
 	uint32_t size;
-	uint32_t backup_handle;
+	uint32_t backup_handle = 0;
 
 	if (req->multisample_count != 0)
 		return -EINVAL;
@@ -1317,12 +1317,16 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
 		ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle,
 					     &res->backup,
 					     &user_srf->backup_base);
-		if (ret == 0 && res->backup->base.num_pages * PAGE_SIZE <
-		    res->backup_size) {
-			DRM_ERROR("Surface backup buffer is too small.\n");
-			vmw_dmabuf_unreference(&res->backup);
-			ret = -EINVAL;
-			goto out_unlock;
+		if (ret == 0) {
+			if (res->backup->base.num_pages * PAGE_SIZE <
+			    res->backup_size) {
+				DRM_ERROR("Surface backup buffer is too small.\n");
+				vmw_dmabuf_unreference(&res->backup);
+				ret = -EINVAL;
+				goto out_unlock;
+			} else {
+				backup_handle = req->buffer_handle;
+			}
 		}
 	} else if (req->drm_surface_flags & drm_vmw_surface_flag_create_buffer)
 		ret = vmw_user_dmabuf_alloc(dev_priv, tfile,
path: drivers/gpu/drm/vmwgfx/vmwgfx_surface.c