linux-kernel - [PATCH] agp: fix a couple integer overflows in agp_allocate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20210908052855.GA28725@kili>
Date:   Wed, 8 Sep 2021 08:28:55 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     David Airlie <airlied@...ux.ie>
Cc:     linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org
Subject: [PATCH] agp: fix a couple integer overflows in agp_allocate_memory()

The "page_count" variable comes from the user in agpioc_allocate_wrap().
The agp_allocate_memory() function has one integer overflow check
already but there are a couple other ways that this can overflow and
we need to check for that as well.

I used INT_MAX as the limit because "scratch_pages" is type int and
because kvmalloc() function will WARN() now if you try to allocate
more than INT_MAX.

Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
---
 drivers/char/agp/generic.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 3ffbb1c80c5c..59aa4f61c66f 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -127,6 +127,9 @@ struct agp_memory *agp_create_memory(int scratch_pages)
 {
 	struct agp_memory *new;
 
+	if (scratch_pages > INT_MAX / PAGE_SIZE)
+		return NULL;
+
 	new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
 	if (new == NULL)
 		return NULL;
@@ -228,7 +231,8 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
 
 	cur_memory = atomic_read(&bridge->current_memory_agp);
 	if ((cur_memory + page_count > bridge->max_memory_agp) ||
-	    (cur_memory + page_count < page_count))
+	    (cur_memory + page_count < page_count) ||
+	    (page_count > INT_MAX - ENTRIES_PER_PAGE - 1))
 		return NULL;
 
 	if (type >= AGP_USER_TYPES) {
-- 
2.20.1