svn commit: r341402 - in head/sys: arm/ti dev/altera/avgen dev/terasic/mtl

[Konstantin Belousov]

Author: kib
Date: Sun Dec  2 18:30:58 2018
New Revision: 341402
URL: https://svnweb.freebsd.org/changeset/base/341402

Log:
  Fix off-by-one (page) errors in checks in d_mmap methods of several drivers.
  
  Reported by:	C Turt <ecturt at gmail.com>
  Reviewed by:	alc, markj
  admbug:		781
  MFC after:	2 weeks
  Sponsored by:	The FreeBSD Foundation

Modified:
  head/sys/arm/ti/ti_pruss.c
  head/sys/dev/altera/avgen/altera_avgen.c
  head/sys/dev/terasic/mtl/terasic_mtl_reg.c
  head/sys/dev/terasic/mtl/terasic_mtl_text.c

Modified: head/sys/arm/ti/ti_pruss.c
==============================================================================
--- head/sys/arm/ti/ti_pruss.c	Sun Dec  2 18:08:27 2018	(r341401)
+++ head/sys/arm/ti/ti_pruss.c	Sun Dec  2 18:30:58 2018	(r341402)
@@ -704,7 +704,7 @@ ti_pruss_mmap(struct cdev *cdev, vm_ooffset_t offset, 
 	device_t dev = cdev->si_drv1;
 	struct ti_pruss_softc *sc = device_get_softc(dev);
 
-	if (offset > rman_get_size(sc->sc_mem_res))
+	if (offset >= rman_get_size(sc->sc_mem_res))
 		return (ENOSPC);
 	*paddr = rman_get_start(sc->sc_mem_res) + offset;
 	*memattr = VM_MEMATTR_UNCACHEABLE;

Modified: head/sys/dev/altera/avgen/altera_avgen.c
==============================================================================
--- head/sys/dev/altera/avgen/altera_avgen.c	Sun Dec  2 18:08:27 2018	(r341401)
+++ head/sys/dev/altera/avgen/altera_avgen.c	Sun Dec  2 18:30:58 2018	(r341402)
@@ -229,6 +229,7 @@ altera_avgen_mmap(struct cdev *dev, vm_ooffset_t offse
 			return (EACCES);
 	}
 	if (trunc_page(offset) == offset &&
+	    offset + PAGE_SIZE > offset &&
 	    rman_get_size(sc->avg_res) >= offset + PAGE_SIZE) {
 		*paddr = rman_get_start(sc->avg_res) + offset;
 		*memattr = VM_MEMATTR_UNCACHEABLE;

Modified: head/sys/dev/terasic/mtl/terasic_mtl_reg.c
==============================================================================
--- head/sys/dev/terasic/mtl/terasic_mtl_reg.c	Sun Dec  2 18:08:27 2018	(r341401)
+++ head/sys/dev/terasic/mtl/terasic_mtl_reg.c	Sun Dec  2 18:30:58 2018	(r341402)
@@ -132,6 +132,7 @@ terasic_mtl_reg_mmap(struct cdev *dev, vm_ooffset_t of
 	sc = dev->si_drv1;
 	error = 0;
 	if (trunc_page(offset) == offset &&
+	    offset + PAGE_SIZE > offset &&
 	    rman_get_size(sc->mtl_reg_res) >= offset + PAGE_SIZE) {
 		*paddr = rman_get_start(sc->mtl_reg_res) + offset;
 		*memattr = VM_MEMATTR_UNCACHEABLE;

Modified: head/sys/dev/terasic/mtl/terasic_mtl_text.c
==============================================================================
--- head/sys/dev/terasic/mtl/terasic_mtl_text.c	Sun Dec  2 18:08:27 2018	(r341401)
+++ head/sys/dev/terasic/mtl/terasic_mtl_text.c	Sun Dec  2 18:30:58 2018	(r341402)
@@ -131,6 +131,7 @@ terasic_mtl_text_mmap(struct cdev *dev, vm_ooffset_t o
 	sc = dev->si_drv1;
 	error = 0;
 	if (trunc_page(offset) == offset &&
+	    offset + PAGE_SIZE > offset &&
 	    rman_get_size(sc->mtl_text_res) >= offset + PAGE_SIZE) {
 		*paddr = rman_get_start(sc->mtl_text_res) + offset;
 		*memattr = VM_MEMATTR_UNCACHEABLE;