1 files changed, 3 insertions, 0 deletions

diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
index ee06f382339b..679d7f972439 100644
--- a/drivers/char/agp/frontend.c
+++ b/drivers/char/agp/frontend.c
@@ -892,6 +892,9 @@ static int agpioc_allocate_wrap(struct agp_file_private *priv, void __user *arg)
         if (copy_from_user(&alloc, arg, sizeof(struct agp_allocate)))
                 return -EFAULT;
 
+        if (alloc.type >= AGP_USER_TYPES)
+                return -EINVAL;
+
         memory = agp_allocate_memory_wrap(alloc.pg_count, alloc.type);
 
         if (memory == NULL)