[PATCH] agp: fix a couple integer overflows in agp_allocate_memory()

[PATCH] agp: fix a couple integer overflows in agp_allocate_memory()

[Dan Carpenter]

The "page_count" variable comes from the user in agpioc_allocate_wrap().
The agp_allocate_memory() function has one integer overflow check
already but there are a couple other ways that this can overflow and
we need to check for that as well.

I used INT_MAX as the limit because "scratch_pages" is type int and
because kvmalloc() function will WARN() now if you try to allocate
more than INT_MAX.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/char/agp/generic.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 3ffbb1c80c5c..59aa4f61c66f 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -127,6 +127,9 @@ struct agp_memory *agp_create_memory(int scratch_pages)
 {
 	struct agp_memory *new;
 
+	if (scratch_pages > INT_MAX / PAGE_SIZE)
+		return NULL;
+
 	new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
 	if (new == NULL)
 		return NULL;
@@ -228,7 +231,8 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
 
 	cur_memory = atomic_read(&bridge->current_memory_agp);
 	if ((cur_memory + page_count > bridge->max_memory_agp) ||
-	    (cur_memory + page_count < page_count))
+	    (cur_memory + page_count < page_count) ||
+	    (page_count > INT_MAX - ENTRIES_PER_PAGE - 1))
 		return NULL;
 
 	if (type >= AGP_USER_TYPES) {
-- 
2.20.1