b522f02184
page_count is copied from userspace. agp_allocate_memory() tries to check whether this number is too big, but doesn't take into account the wrap case. Also agp_create_user_memory() doesn't check whether alloc_size is calculated from num_agp_pages variable without overflow. This may lead to allocation of too small buffer with following buffer overflow. Another problem in agp code is not addressed in the patch - kernel memory exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls). It is not checked whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()). Each allocation is limited to 16KB, though, there is no per-process limit. This might lead to OOM situation, which is not even solved in case of the caller death by OOM killer - the memory is allocated for another (faked) process. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Dave Airlie <airlied@redhat.com> |
||
---|---|---|
.. | ||
agp | ||
hw_random | ||
ipmi | ||
mwave | ||
pcmcia | ||
tpm | ||
xilinx_hwicap | ||
apm-emulation.c | ||
applicom.c | ||
applicom.h | ||
bfin-otp.c | ||
briq_panel.c | ||
bsr.c | ||
ds1302.c | ||
ds1620.c | ||
dsp56k.c | ||
dtlk.c | ||
efirtc.c | ||
generic_nvram.c | ||
genrtc.c | ||
hangcheck-timer.c | ||
hpet.c | ||
i8k.c | ||
Kconfig | ||
lp.c | ||
Makefile | ||
mbcs.c | ||
mbcs.h | ||
mem.c | ||
misc.c | ||
mmtimer.c | ||
msm_smd_pkt.c | ||
mspec.c | ||
nsc_gpio.c | ||
nvram.c | ||
nwbutton.c | ||
nwbutton.h | ||
nwflash.c | ||
pc8736x_gpio.c | ||
ppdev.c | ||
ps3flash.c | ||
ramoops.c | ||
random.c | ||
raw.c | ||
rtc.c | ||
scc.h | ||
scx200_gpio.c | ||
snsc.c | ||
snsc.h | ||
snsc_event.c | ||
sonypi.c | ||
tb0219.c | ||
tlclk.c | ||
toshiba.c | ||
ttyprintk.c | ||
uv_mmtimer.c | ||
viotape.c | ||
virtio_console.c |