diff options
author | Vasiliy Kulikov <segoon@openwall.com> | 2011-04-14 20:55:19 +0400 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-05-02 09:19:47 -0700 |
commit | 767a7e6906bd2b31c14bd57df8834da0cc81606e (patch) | |
tree | 49b395ee1d9dba80717e2f5cbb93b70c57663244 /drivers/target/target_core_tmr.c | |
parent | 0b7c6323a28f3fde67a26bc6b2a889d3f23b12c3 (diff) |
agp: fix OOM and buffer overflow
commit b522f02184b413955f3bc952e3776ce41edc6355 upstream.
page_count is copied from userspace. agp_allocate_memory() tries to
check whether this number is too big, but doesn't take into account the
wrap case. Also agp_create_user_memory() doesn't check whether
alloc_size is calculated from num_agp_pages variable without overflow.
This may lead to allocation of too small buffer with following buffer
overflow.
Another problem in agp code is not addressed in the patch - kernel memory
exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls). It is not checked
whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()).
Each allocation is limited to 16KB, though, there is no per-process limit.
This might lead to OOM situation, which is not even solved in case of the
caller death by OOM killer - the memory is allocated for another (faked) process.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/target/target_core_tmr.c')
0 files changed, 0 insertions, 0 deletions