--- drivers/char/agp/generic.c

+++ drivers/char/agp/generic.c

@@ -123,9 +123,6 @@ static struct agp_memory *agp_create_use

struct agp_memory *new;

unsigned long alloc_size = num_agp_pages*sizeof(struct page *);

- if (INT_MAX/sizeof(struct page *) < num_agp_pages)

- return NULL;

-

new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);

if (new == NULL)

return NULL;

@@ -245,14 +242,11 @@ struct agp_memory *agp_allocate_memory(s

int scratch_pages;

struct agp_memory *new;

size_t i;

- int cur_memory;

if (!bridge)

return NULL;

- cur_memory = atomic_read(&bridge->current_memory_agp);

- if ((cur_memory + page_count > bridge->max_memory_agp) ||

- (cur_memory + page_count < page_count))

+ if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)

return NULL;

if (type >= AGP_USER_TYPES) {

@@ -1129,8 +1123,8 @@ int agp_generic_insert_memory(struct agp

return -EINVAL;

}

- if (((pg_start + mem->page_count) > num_entries) ||

- ((pg_start + mem->page_count) < pg_start))

+ /* AK: could wrap */

+ if ((pg_start + mem->page_count) > num_entries)

return -EINVAL;

j = pg_start;

@@ -1164,7 +1158,7 @@ int agp_generic_remove_memory(struct agp

{

size_t i;

struct agp_bridge_data *bridge;

- int mask_type, num_entries;

+ int mask_type;

bridge = mem->bridge;

if (!bridge)

@@ -1176,11 +1170,6 @@ int agp_generic_remove_memory(struct agp

if (type != mem->type)

return -EINVAL;

- num_entries = agp_num_entries();

- if (((pg_start + mem->page_count) > num_entries) ||

- ((pg_start + mem->page_count) < pg_start))

- return -EINVAL;

-

mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);

if (mask_type != 0) {

/* The generic routines know nothing of memory types */