diff options
Diffstat (limited to 'drivers/char/agp')
| -rw-r--r-- | drivers/char/agp/agp.h | 2 | ||||
| -rw-r--r-- | drivers/char/agp/amd-k7-agp.c | 2 | ||||
| -rw-r--r-- | drivers/char/agp/generic.c | 19 | ||||
| -rw-r--r-- | drivers/char/agp/sworks-agp.c | 2 | ||||
| -rw-r--r-- | drivers/char/agp/via-agp.c | 2 |
5 files changed, 19 insertions, 8 deletions
diff --git a/drivers/char/agp/agp.h b/drivers/char/agp/agp.h index 3e67ddde9e1..923f99df4f1 100644 --- a/drivers/char/agp/agp.h +++ b/drivers/char/agp/agp.h @@ -237,7 +237,7 @@ extern int agp_try_unsupported_boot; long compat_agp_ioctl(struct file *file, unsigned int cmd, unsigned long arg); -/* Chipset independant registers (from AGP Spec) */ +/* Chipset independent registers (from AGP Spec) */ #define AGP_APBASE 0x10 #define AGPSTAT 0x4 diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c index 45681c0ff3b..f7e88787af9 100644 --- a/drivers/char/agp/amd-k7-agp.c +++ b/drivers/char/agp/amd-k7-agp.c @@ -272,7 +272,7 @@ static void amd_irongate_cleanup(void) * This routine could be implemented by taking the addresses * written to the GATT, and flushing them individually. However * currently it just flushes the whole table. Which is probably - * more efficent, since agp_memory blocks can be a large number of + * more efficient, since agp_memory blocks can be a large number of * entries. */ diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c index 012cba0d6d9..b072648dc3f 100644 --- a/drivers/char/agp/generic.c +++ b/drivers/char/agp/generic.c @@ -115,6 +115,9 @@ static struct agp_memory *agp_create_user_memory(unsigned long num_agp_pages) struct agp_memory *new; unsigned long alloc_size = num_agp_pages*sizeof(struct page *); + if (INT_MAX/sizeof(struct page *) < num_agp_pages) + return NULL; + new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL); if (new == NULL) return NULL; @@ -234,11 +237,14 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge, int scratch_pages; struct agp_memory *new; size_t i; + int cur_memory; if (!bridge) return NULL; - if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp) + cur_memory = atomic_read(&bridge->current_memory_agp); + if ((cur_memory + page_count > bridge->max_memory_agp) || + (cur_memory + page_count < page_count)) return NULL; if (type >= AGP_USER_TYPES) { @@ -1089,8 +1095,8 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type) return -EINVAL; } - /* AK: could wrap */ - if ((pg_start + mem->page_count) > num_entries) + if (((pg_start + mem->page_count) > num_entries) || + ((pg_start + mem->page_count) < pg_start)) return -EINVAL; j = pg_start; @@ -1124,7 +1130,7 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type) { size_t i; struct agp_bridge_data *bridge; - int mask_type; + int mask_type, num_entries; bridge = mem->bridge; if (!bridge) @@ -1136,6 +1142,11 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type) if (type != mem->type) return -EINVAL; + num_entries = agp_num_entries(); + if (((pg_start + mem->page_count) > num_entries) || + ((pg_start + mem->page_count) < pg_start)) + return -EINVAL; + mask_type = bridge->driver->agp_type_to_mask_type(bridge, type); if (mask_type != 0) { /* The generic routines know nothing of memory types */ diff --git a/drivers/char/agp/sworks-agp.c b/drivers/char/agp/sworks-agp.c index 13acaaf64ed..f02f9b07fd4 100644 --- a/drivers/char/agp/sworks-agp.c +++ b/drivers/char/agp/sworks-agp.c @@ -229,7 +229,7 @@ static int serverworks_fetch_size(void) * This routine could be implemented by taking the addresses * written to the GATT, and flushing them individually. However * currently it just flushes the whole table. Which is probably - * more efficent, since agp_memory blocks can be a large number of + * more efficient, since agp_memory blocks can be a large number of * entries. */ static void serverworks_tlbflush(struct agp_memory *temp) diff --git a/drivers/char/agp/via-agp.c b/drivers/char/agp/via-agp.c index df67e80019d..8bc38493740 100644 --- a/drivers/char/agp/via-agp.c +++ b/drivers/char/agp/via-agp.c @@ -400,7 +400,7 @@ static struct agp_device_ids via_agp_device_ids[] __devinitdata = * the traditional AGP which resides only in chipset. AGP is used * by 3D driver which wasn't available for the VT3336 and VT3364 * generation until now. Unfortunately, by testing, VT3364 works - * but VT3336 doesn't. - explaination from via, just leave this as + * but VT3336 doesn't. - explanation from via, just leave this as * as a placeholder to avoid future patches adding it back in. */ #if 0 |