Fix off-by-one (page) errors in checks in d_mmap methods of several d…

…rivers. Reported by: C Turt <ecturt@gmail.com> Reviewed by: alc, markj admbug: 781 MFC after: 2 weeks Sponsored by: The FreeBSD Foundation
freebsd · Dec 2, 2018 · 6dc9024 · 6dc9024
1 parent 311df7e
commit 6dc9024
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 1 deletion.
diff --git a/sys/arm/ti/ti_pruss.c b/sys/arm/ti/ti_pruss.c
@@ -704,7 +704,7 @@ ti_pruss_mmap(struct cdev *cdev, vm_ooffset_t offset, vm_paddr_t *paddr,
 	device_t dev = cdev->si_drv1;
 	struct ti_pruss_softc *sc = device_get_softc(dev);
 
-	if (offset > rman_get_size(sc->sc_mem_res))
+	if (offset >= rman_get_size(sc->sc_mem_res))
 		return (ENOSPC);
 	*paddr = rman_get_start(sc->sc_mem_res) + offset;
 	*memattr = VM_MEMATTR_UNCACHEABLE;

diff --git a/sys/dev/altera/avgen/altera_avgen.c b/sys/dev/altera/avgen/altera_avgen.c
@@ -229,6 +229,7 @@ altera_avgen_mmap(struct cdev *dev, vm_ooffset_t offset, vm_paddr_t *paddr,
 			return (EACCES);
 	}
 	if (trunc_page(offset) == offset &&
+	    offset + PAGE_SIZE > offset &&
 	    rman_get_size(sc->avg_res) >= offset + PAGE_SIZE) {
 		*paddr = rman_get_start(sc->avg_res) + offset;
 		*memattr = VM_MEMATTR_UNCACHEABLE;

diff --git a/sys/dev/terasic/mtl/terasic_mtl_reg.c b/sys/dev/terasic/mtl/terasic_mtl_reg.c
@@ -132,6 +132,7 @@ terasic_mtl_reg_mmap(struct cdev *dev, vm_ooffset_t offset, vm_paddr_t *paddr,
 	sc = dev->si_drv1;
 	error = 0;
 	if (trunc_page(offset) == offset &&
+	    offset + PAGE_SIZE > offset &&
 	    rman_get_size(sc->mtl_reg_res) >= offset + PAGE_SIZE) {
 		*paddr = rman_get_start(sc->mtl_reg_res) + offset;
 		*memattr = VM_MEMATTR_UNCACHEABLE;

diff --git a/sys/dev/terasic/mtl/terasic_mtl_text.c b/sys/dev/terasic/mtl/terasic_mtl_text.c
@@ -131,6 +131,7 @@ terasic_mtl_text_mmap(struct cdev *dev, vm_ooffset_t offset,
 	sc = dev->si_drv1;
 	error = 0;
 	if (trunc_page(offset) == offset &&
+	    offset + PAGE_SIZE > offset &&
 	    rman_get_size(sc->mtl_text_res) >= offset + PAGE_SIZE) {
 		*paddr = rman_get_start(sc->mtl_text_res) + offset;
 		*memattr = VM_MEMATTR_UNCACHEABLE;