forked from Minki/linux
b522f02184
page_count is copied from userspace. agp_allocate_memory() tries to check whether this number is too big, but doesn't take into account the wrap case. Also agp_create_user_memory() doesn't check whether alloc_size is calculated from num_agp_pages variable without overflow. This may lead to allocation of too small buffer with following buffer overflow. Another problem in agp code is not addressed in the patch - kernel memory exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls). It is not checked whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()). Each allocation is limited to 16KB, though, there is no per-process limit. This might lead to OOM situation, which is not even solved in case of the caller death by OOM killer - the memory is allocated for another (faked) process. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Dave Airlie <airlied@redhat.com> |
||
|---|---|---|
| .. | ||
| agp.h | ||
| ali-agp.c | ||
| alpha-agp.c | ||
| amd64-agp.c | ||
| amd-k7-agp.c | ||
| ati-agp.c | ||
| backend.c | ||
| compat_ioctl.c | ||
| compat_ioctl.h | ||
| efficeon-agp.c | ||
| frontend.c | ||
| generic.c | ||
| hp-agp.c | ||
| i460-agp.c | ||
| intel-agp.c | ||
| intel-agp.h | ||
| intel-gtt.c | ||
| isoch.c | ||
| Kconfig | ||
| Makefile | ||
| nvidia-agp.c | ||
| parisc-agp.c | ||
| sgi-agp.c | ||
| sis-agp.c | ||
| sworks-agp.c | ||
| uninorth-agp.c | ||
| via-agp.c | ||