d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix off-by-one (page) errors in checks in d_mmap methods of several drivers.

Browse Source 
Reported by:	C Turt <ecturt@gmail.com>
Reviewed by:	alc, markj
admbug:		781
MFC after:	2 weeks
Sponsored by:	The FreeBSD Foundation
This commit is contained in:
kib 2018-12-02 18:30:58 +00:00
parent 311df7ee73
commit 6dc902485b
4 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/arm/ti/ti_pruss.c
View File

@ -704,7 +704,7 @@ ti_pruss_mmap(struct cdev *cdev, vm_ooffset_t offset, vm_paddr_t *paddr,
device_t dev = cdev->si_drv1;
struct ti_pruss_softc *sc = device_get_softc(dev);
if (offset > rman_get_size(sc->sc_mem_res))
if (offset >= rman_get_size(sc->sc_mem_res))
return (ENOSPC);
*paddr = rman_get_start(sc->sc_mem_res) + offset;
*memattr = VM_MEMATTR_UNCACHEABLE;

1
sys/dev/altera/avgen/altera_avgen.c
View File

@ -229,6 +229,7 @@ altera_avgen_mmap(struct cdev *dev, vm_ooffset_t offset, vm_paddr_t *paddr,
return (EACCES);
}
if (trunc_page(offset) == offset &&
offset + PAGE_SIZE > offset &&
rman_get_size(sc->avg_res) >= offset + PAGE_SIZE) {
*paddr = rman_get_start(sc->avg_res) + offset;
*memattr = VM_MEMATTR_UNCACHEABLE;

1
sys/dev/terasic/mtl/terasic_mtl_reg.c
View File

@ -132,6 +132,7 @@ terasic_mtl_reg_mmap(struct cdev *dev, vm_ooffset_t offset, vm_paddr_t *paddr,
sc = dev->si_drv1;
error = 0;
if (trunc_page(offset) == offset &&
offset + PAGE_SIZE > offset &&
rman_get_size(sc->mtl_reg_res) >= offset + PAGE_SIZE) {
*paddr = rman_get_start(sc->mtl_reg_res) + offset;
*memattr = VM_MEMATTR_UNCACHEABLE;

1
sys/dev/terasic/mtl/terasic_mtl_text.c
View File

@ -131,6 +131,7 @@ terasic_mtl_text_mmap(struct cdev *dev, vm_ooffset_t offset,
sc = dev->si_drv1;
error = 0;
if (trunc_page(offset) == offset &&
offset + PAGE_SIZE > offset &&
rman_get_size(sc->mtl_text_res) >= offset + PAGE_SIZE) {
*paddr = rman_get_start(sc->mtl_text_res) + offset;
*memattr = VM_MEMATTR_UNCACHEABLE;