Skip site navigation (1)Skip section navigation (2) 
Date:      Sun, 16 Dec 2018 02:46:51 +0000 (UTC)
From:      Konstantin Belousov <kib@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org
Subject:   svn commit: r342149 - in stable/12/sys: arm/ti dev/altera/avgen dev/terasic/mtl
Message-ID:  <201812160246.wBG2kp99037272@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: kib
Date: Sun Dec 16 02:46:51 2018
New Revision: 342149
URL: https://svnweb.freebsd.org/changeset/base/342149

Log:
  MFC r341402:
  Fix off-by-one (page) errors in checks in d_mmap methods of several drivers.

Modified:
  stable/12/sys/arm/ti/ti_pruss.c
  stable/12/sys/dev/altera/avgen/altera_avgen.c
  stable/12/sys/dev/terasic/mtl/terasic_mtl_reg.c
  stable/12/sys/dev/terasic/mtl/terasic_mtl_text.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/arm/ti/ti_pruss.c
==============================================================================
--- stable/12/sys/arm/ti/ti_pruss.c	Sun Dec 16 02:46:09 2018	(r342148)
+++ stable/12/sys/arm/ti/ti_pruss.c	Sun Dec 16 02:46:51 2018	(r342149)
@@ -704,7 +704,7 @@ ti_pruss_mmap(struct cdev *cdev, vm_ooffset_t offset, 
 	device_t dev = cdev->si_drv1;
 	struct ti_pruss_softc *sc = device_get_softc(dev);
 
-	if (offset > rman_get_size(sc->sc_mem_res))
+	if (offset >= rman_get_size(sc->sc_mem_res))
 		return (ENOSPC);
 	*paddr = rman_get_start(sc->sc_mem_res) + offset;
 	*memattr = VM_MEMATTR_UNCACHEABLE;

Modified: stable/12/sys/dev/altera/avgen/altera_avgen.c
==============================================================================
--- stable/12/sys/dev/altera/avgen/altera_avgen.c	Sun Dec 16 02:46:09 2018	(r342148)
+++ stable/12/sys/dev/altera/avgen/altera_avgen.c	Sun Dec 16 02:46:51 2018	(r342149)
@@ -229,6 +229,7 @@ altera_avgen_mmap(struct cdev *dev, vm_ooffset_t offse
 			return (EACCES);
 	}
 	if (trunc_page(offset) == offset &&
+	    offset + PAGE_SIZE > offset &&
 	    rman_get_size(sc->avg_res) >= offset + PAGE_SIZE) {
 		*paddr = rman_get_start(sc->avg_res) + offset;
 		*memattr = VM_MEMATTR_UNCACHEABLE;

Modified: stable/12/sys/dev/terasic/mtl/terasic_mtl_reg.c
==============================================================================
--- stable/12/sys/dev/terasic/mtl/terasic_mtl_reg.c	Sun Dec 16 02:46:09 2018	(r342148)
+++ stable/12/sys/dev/terasic/mtl/terasic_mtl_reg.c	Sun Dec 16 02:46:51 2018	(r342149)
@@ -132,6 +132,7 @@ terasic_mtl_reg_mmap(struct cdev *dev, vm_ooffset_t of
 	sc = dev->si_drv1;
 	error = 0;
 	if (trunc_page(offset) == offset &&
+	    offset + PAGE_SIZE > offset &&
 	    rman_get_size(sc->mtl_reg_res) >= offset + PAGE_SIZE) {
 		*paddr = rman_get_start(sc->mtl_reg_res) + offset;
 		*memattr = VM_MEMATTR_UNCACHEABLE;

Modified: stable/12/sys/dev/terasic/mtl/terasic_mtl_text.c
==============================================================================
--- stable/12/sys/dev/terasic/mtl/terasic_mtl_text.c	Sun Dec 16 02:46:09 2018	(r342148)
+++ stable/12/sys/dev/terasic/mtl/terasic_mtl_text.c	Sun Dec 16 02:46:51 2018	(r342149)
@@ -131,6 +131,7 @@ terasic_mtl_text_mmap(struct cdev *dev, vm_ooffset_t o
 	sc = dev->si_drv1;
 	error = 0;
 	if (trunc_page(offset) == offset &&
+	    offset + PAGE_SIZE > offset &&
 	    rman_get_size(sc->mtl_text_res) >= offset + PAGE_SIZE) {
 		*paddr = rman_get_start(sc->mtl_text_res) + offset;
 		*memattr = VM_MEMATTR_UNCACHEABLE;

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201812160246.wBG2kp99037272>