lkml.org 
[lkml]   [2021]   [Sep]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] agp: fix a couple integer overflows in agp_allocate_memory()
The "page_count" variable comes from the user in agpioc_allocate_wrap().
The agp_allocate_memory() function has one integer overflow check
already but there are a couple other ways that this can overflow and
we need to check for that as well.

I used INT_MAX as the limit because "scratch_pages" is type int and
because kvmalloc() function will WARN() now if you try to allocate
more than INT_MAX.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/char/agp/generic.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 3ffbb1c80c5c..59aa4f61c66f 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -127,6 +127,9 @@ struct agp_memory *agp_create_memory(int scratch_pages)
{
struct agp_memory *new;

+ if (scratch_pages > INT_MAX / PAGE_SIZE)
+ return NULL;
+
new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
if (new == NULL)
return NULL;
@@ -228,7 +231,8 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,

cur_memory = atomic_read(&bridge->current_memory_agp);
if ((cur_memory + page_count > bridge->max_memory_agp) ||
- (cur_memory + page_count < page_count))
+ (cur_memory + page_count < page_count) ||
+ (page_count > INT_MAX - ENTRIES_PER_PAGE - 1))
return NULL;

if (type >= AGP_USER_TYPES) {
--
2.20.1
\
 
 \ /
  Last update: 2021-09-08 07:30    [W:0.056 / U:1.060 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site