DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type:content-transfer-encoding;
        b=xp39Hfd2X6fUhe0fn0M6CFe/q+MRfn9uyRY65K3hjSOemqCk5HwUgk45m36ggt0Nr/
         TfjXnX0Hid/AJNo6/8SqucA0MVV2Qkh8uJwbFkLm5voBx+2wV67/5e960bpd0mc4FU/o
         dnpXnI4ZjDK5U9UZnIti1/p7tJshK+agKb9sc=
MIME-Version: 1.0
In-Reply-To: <1302800120-31560-1-git-send-email-segoon@openwall.com>
References: <1302800120-31560-1-git-send-email-segoon@openwall.com>
Date: Thu, 14 Apr 2011 21:07:36 +0400
Message-ID: <BANLkTimNgb+5W4kjKiarRAU=EH=X=_vUzQ@mail.gmail.com>
Subject: Re: [PATCH] char: agp: fix OOM and buffer overflow
From: Vasiliy Kulikov <segooon@gmail.com>
To: linux-kernel@vger.kernel.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8BIT
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 739
Lines: 13

> - ? ? ? if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)
> + ? ? ? cur_memory = atomic_read(&bridge->current_memory_agp);
> + ? ? ? if ((cur_memory + page_count > bridge->max_memory_agp) ||
> + ? ? ? ? ? (cur_memory + page_count < page_count))
I should have said that current_memory_agp is already protected by
agp_fe.agp_mutex, so the patch doesn't break atomic operation
(otherwise there is also a race between the check and use of
current_memory_agp).
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/