--- common/lib/modules/fglrx/build_mod/2.6.x/Makefile +++ common/lib/modules/fglrx/build_mod/2.6.x/Makefile @@ -67,6 +67,7 @@ EXTRA_CFLAGS += \ -DFGL_LINUX253P1_VMA_API \ -DPAGE_ATTR_FIX=$(PAGE_ATTR_FIX) \ + EXTRA_CFLAGS +=-DARCH_COMPAT_ALLOC_USER_SPACE ifeq ($(KERNELRELEASE),) # on first call from remote location we get into this path # whilst on second call all is managed by the embedding kernel makefile --- common/lib/modules/fglrx/build_mod/kcl_ioctl.c +++ common/lib/modules/fglrx/build_mod/kcl_ioctl.c @@ -193,7 +193,19 @@ */ void* ATI_API_CALL KCL_IOCTL_AllocUserSpace32(long size) { - return compat_alloc_user_space(size); + void __user *ptr; + + /* If len occupies more than half of the entire compat space... */ + if (unlikely(((unsigned long) size) > (((compat_uptr_t)~0) >> 1))) + return NULL; + + ptr = arch_compat_alloc_user_space(size); + + + if (unlikely(!access_ok(VERIFY_WRITE, ptr, size))) + return NULL; + + return ptr; } #endif // __x86_64__