The "page_count" variable comes from the user in agpioc_allocate_wrap().
The agp_allocate_memory() function has one integer overflow check
already but there are a couple other ways that this can overflow and
we need to check for that as well.
I used INT_MAX as the limit because "scratch_pages" is type int and
because kvmalloc() function will WARN() now if you try to allocate
more than INT_MAX.
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
---
drivers/char/agp/generic.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 3ffbb1c80c5c..59aa4f61c66f 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -127,6 +127,9 @@ struct agp_memory *agp_create_memory(int scratch_pages)
{
struct agp_memory *new;
+ if (scratch_pages > INT_MAX / PAGE_SIZE)
+ return NULL;
+
new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
if (new == NULL)
return NULL;
@@ -228,7 +231,8 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
cur_memory = atomic_read(&bridge->current_memory_agp);
if ((cur_memory + page_count > bridge->max_memory_agp) ||
- (cur_memory + page_count < page_count))
+ (cur_memory + page_count < page_count) ||
+ (page_count > INT_MAX - ENTRIES_PER_PAGE - 1))
return NULL;
if (type >= AGP_USER_TYPES) {
--
2.20.1
