[kernel] r17292 - in dists/squeeze/linux-2.6/debian: . patches/bugfix/all patches/series

[Dann Frazier]

Author: dannf
Date: Tue May  3 05:58:59 2011
New Revision: 17292

Log:
agp: fix OOM and buffer overflow (CVE-2011-1746)

Added:
   dists/squeeze/linux-2.6/debian/patches/bugfix/all/agp-fix-OOM-and-buffer-overflow.patch
Modified:
   dists/squeeze/linux-2.6/debian/changelog
   dists/squeeze/linux-2.6/debian/patches/series/34

Modified: dists/squeeze/linux-2.6/debian/changelog
==============================================================================
--- dists/squeeze/linux-2.6/debian/changelog	Tue May  3 05:58:48 2011	(r17291)
+++ dists/squeeze/linux-2.6/debian/changelog	Tue May  3 05:58:59 2011	(r17292)
@@ -70,6 +70,7 @@
   * can: Add missing socket check in can/bcm release (CVE-2011-1598)
   * can: Add missing socket check in can/raw release (CVE-2011-1748)
   * agp: fix arbitrary kernel memory writes (CVE-2011-1745)
+  * agp: fix OOM and buffer overflow (CVE-2011-1746)
 
  -- Ben Hutchings <ben at decadent.org.uk>  Fri, 08 Apr 2011 01:13:01 +0100
 

Added: dists/squeeze/linux-2.6/debian/patches/bugfix/all/agp-fix-OOM-and-buffer-overflow.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/squeeze/linux-2.6/debian/patches/bugfix/all/agp-fix-OOM-and-buffer-overflow.patch	Tue May  3 05:58:59 2011	(r17292)
@@ -0,0 +1,53 @@
+commit b522f02184b413955f3bc952e3776ce41edc6355
+Author: Vasiliy Kulikov <segoon at openwall.com>
+Date:   Thu Apr 14 20:55:19 2011 +0400
+
+    agp: fix OOM and buffer overflow
+    
+    page_count is copied from userspace.  agp_allocate_memory() tries to
+    check whether this number is too big, but doesn't take into account the
+    wrap case.  Also agp_create_user_memory() doesn't check whether
+    alloc_size is calculated from num_agp_pages variable without overflow.
+    This may lead to allocation of too small buffer with following buffer
+    overflow.
+    
+    Another problem in agp code is not addressed in the patch - kernel memory
+    exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls).  It is not checked
+    whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()).
+    Each allocation is limited to 16KB, though, there is no per-process limit.
+    This might lead to OOM situation, which is not even solved in case of the
+    caller death by OOM killer - the memory is allocated for another (faked) process.
+    
+    Signed-off-by: Vasiliy Kulikov <segoon at openwall.com>
+    Signed-off-by: Dave Airlie <airlied at redhat.com>
+
+diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
+index 012cba0..850a643 100644
+--- a/drivers/char/agp/generic.c
++++ b/drivers/char/agp/generic.c
+@@ -115,6 +115,9 @@ static struct agp_memory *agp_create_user_memory(unsigned long num_agp_pages)
+ 	struct agp_memory *new;
+ 	unsigned long alloc_size = num_agp_pages*sizeof(struct page *);
+ 
++	if (INT_MAX/sizeof(struct page *) < num_agp_pages)
++		return NULL;
++
+ 	new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
+ 	if (new == NULL)
+ 		return NULL;
+@@ -234,11 +237,14 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
+ 	int scratch_pages;
+ 	struct agp_memory *new;
+ 	size_t i;
++	int cur_memory;
+ 
+ 	if (!bridge)
+ 		return NULL;
+ 
+-	if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)
++	cur_memory = atomic_read(&bridge->current_memory_agp);
++	if ((cur_memory + page_count > bridge->max_memory_agp) ||
++	    (cur_memory + page_count < page_count))
+ 		return NULL;
+ 
+ 	if (type >= AGP_USER_TYPES) {

Modified: dists/squeeze/linux-2.6/debian/patches/series/34
==============================================================================
--- dists/squeeze/linux-2.6/debian/patches/series/34	Tue May  3 05:58:48 2011	(r17291)
+++ dists/squeeze/linux-2.6/debian/patches/series/34	Tue May  3 05:58:59 2011	(r17292)
@@ -46,3 +46,4 @@
 + bugfix/all/can-add-missing-socket-check-in-can+bcm-release.patch
 + bugfix/all/can-add-missing-socket-check-in-can+raw-release.patch
 + bugfix/all/agp-fix-arbitrary-kernel-memory-writes.patch
++ bugfix/all/agp-fix-OOM-and-buffer-overflow.patch