updated patch

ati-drivers-CVE-2010-3081-fix.patch (text/plain), 1.13 KB, created by kiorky on 2010-10-23 10:29:40 UTC

diff -ur work.orig/common/lib/modules/fglrx/build_mod/kcl_ioctl.c work.cve//common/lib/modules/fglrx/build_mod/kcl_ioctl.c
--- work.orig/common/lib/modules/fglrx/build_mod/kcl_ioctl.c	2010-10-23 10:20:31.871200339 +0000
+++ work.cve//common/lib/modules/fglrx/build_mod/kcl_ioctl.c	2010-10-23 12:24:30.111178036 +0000
@@ -35,6 +35,7 @@
 
 #ifdef __x86_64__
 #   include "asm/compat.h"
+#   include "linux/compat.h"
 #   if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
 #       if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,12)
 #           include "linux/ioctl32.h"
@@ -193,13 +194,17 @@
  */
 void* ATI_API_CALL KCL_IOCTL_AllocUserSpace32(long size)
 {
-    void __user *ret = COMPAT_ALLOC_USER_SPACE(size);
+    void __user *ptr;
 
-    /* prevent stack overflow */
-    if (!access_ok(VERIFY_WRITE, ret, size))
+    /* If size would occupy more than half of the entire compat space... */
+    if (unlikely(size > (((compat_uptr_t)~0) >> 1)))
         return NULL;
+    ptr = arch_compat_alloc_user_space(size);
+    if (unlikely(!access_ok(VERIFY_WRITE, ptr, size)))
+        return NULL;
+
+    return ptr;
 
-    return (void *)ret;
 }
 
 #endif // __x86_64__