https://github.com/torvalds/linux
Revision b522f02184b413955f3bc952e3776ce41edc6355 authored by Vasiliy Kulikov on 14 April 2011, 16:55:19 UTC, committed by Dave Airlie on 21 April 2011, 01:51:04 UTC
page_count is copied from userspace. agp_allocate_memory() tries to check whether this number is too big, but doesn't take into account the wrap case. Also agp_create_user_memory() doesn't check whether alloc_size is calculated from num_agp_pages variable without overflow. This may lead to allocation of too small buffer with following buffer overflow. Another problem in agp code is not addressed in the patch - kernel memory exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls). It is not checked whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()). Each allocation is limited to 16KB, though, there is no per-process limit. This might lead to OOM situation, which is not even solved in case of the caller death by OOM killer - the memory is allocated for another (faked) process. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
1 parent 204ae24
Tip revision: b522f02184b413955f3bc952e3776ce41edc6355 authored by Vasiliy Kulikov on 14 April 2011, 16:55:19 UTC
agp: fix OOM and buffer overflow
agp: fix OOM and buffer overflow
Tip revision: b522f02
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| arch | ||
| block | ||
| crypto | ||
| drivers | ||
| firmware | ||
| fs | ||
| include | ||
| init | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .gitignore | -rw-r--r-- | 941 bytes |
| .mailmap | -rw-r--r-- | 4.1 KB |
| COPYING | -rw-r--r-- | 18.3 KB |
| CREDITS | -rw-r--r-- | 91.7 KB |
| Kbuild | -rw-r--r-- | 2.4 KB |
| Kconfig | -rw-r--r-- | 252 bytes |
| MAINTAINERS | -rw-r--r-- | 187.9 KB |
| Makefile | -rw-r--r-- | 51.1 KB |
| README | -rw-r--r-- | 17.1 KB |
| REPORTING-BUGS | -rw-r--r-- | 3.3 KB |
Computing file changes ...
