Skip site navigation (1)Skip section navigation (2) 
Date:      Thu, 27 Oct 2016 21:23:14 +0000 (UTC)
From:      John Baldwin <jhb@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r308004 - in head/sys: amd64/amd64 i386/i386 x86/include
Message-ID:  <201610272123.u9RLNENb079520@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: jhb
Date: Thu Oct 27 21:23:14 2016
New Revision: 308004
URL: https://svnweb.freebsd.org/changeset/base/308004

Log:
  MFamd64: Add bounds checks on addresses used with /dev/mem.
  
  Reject attempts to read from or memory map offsets in /dev/mem that are
  beyond the maximum-supported physical address of the current CPU.
  
  Reviewed by:	kib
  MFC after:	1 month
  Differential Revision:	https://reviews.freebsd.org/D7408

Modified:
  head/sys/amd64/amd64/mem.c
  head/sys/i386/i386/mem.c
  head/sys/x86/include/x86_var.h

Modified: head/sys/amd64/amd64/mem.c
==============================================================================
--- head/sys/amd64/amd64/mem.c	Thu Oct 27 18:46:52 2016	(r308003)
+++ head/sys/amd64/amd64/mem.c	Thu Oct 27 21:23:14 2016	(r308004)
@@ -140,7 +140,7 @@ memrw(struct cdev *dev, struct uio *uio,
 				error = uiomove((void *)vd, c, uio);
 				break;
 			}
-			if (v >= (1ULL << cpu_maxphyaddr)) {
+			if (v > cpu_getmaxphyaddr()) {
 				error = EFAULT;
 				break;
 			}
@@ -169,7 +169,7 @@ memmmap(struct cdev *dev, vm_ooffset_t o
     int prot __unused, vm_memattr_t *memattr __unused)
 {
 	if (dev2unit(dev) == CDEV_MINOR_MEM) {
-		if (offset >= (1ULL << cpu_maxphyaddr))
+		if (offset > cpu_getmaxphyaddr())
 			return (-1);
 		*paddr = offset;
 		return (0);

Modified: head/sys/i386/i386/mem.c
==============================================================================
--- head/sys/i386/i386/mem.c	Thu Oct 27 18:46:52 2016	(r308003)
+++ head/sys/i386/i386/mem.c	Thu Oct 27 21:23:14 2016	(r308004)
@@ -108,8 +108,11 @@ memrw(struct cdev *dev, struct uio *uio,
 			continue;
 		}
 		if (dev2unit(dev) == CDEV_MINOR_MEM) {
-			pa = uio->uio_offset;
-			pa &= ~PAGE_MASK;
+			if (uio->uio_offset > cpu_getmaxphyaddr()) {
+				error = EFAULT;
+				break;
+			}
+			pa = trunc_page(uio->uio_offset);
 		} else {
 			/*
 			 * Extract the physical page since the mapping may
@@ -162,6 +165,8 @@ memmmap(struct cdev *dev, vm_ooffset_t o
     int prot __unused, vm_memattr_t *memattr __unused)
 {
 	if (dev2unit(dev) == CDEV_MINOR_MEM) {
+		if (offset > cpu_getmaxphyaddr())
+			return (-1);
 		*paddr = offset;
 		return (0);
 	}

Modified: head/sys/x86/include/x86_var.h
==============================================================================
--- head/sys/x86/include/x86_var.h	Thu Oct 27 18:46:52 2016	(r308003)
+++ head/sys/x86/include/x86_var.h	Thu Oct 27 21:23:14 2016	(r308004)
@@ -94,6 +94,20 @@ struct	trapframe;
  */
 typedef void alias_for_inthand_t(void);
 
+/*
+ * Returns the maximum physical address that can be used with the
+ * current system.
+ */
+static __inline vm_paddr_t
+cpu_getmaxphyaddr(void)
+{
+#if defined(__i386__) && !defined(PAE)
+	return (0xffffffff);
+#else
+	return ((1ULL << cpu_maxphyaddr) - 1);
+#endif
+}
+
 void	*alloc_fpusave(int flags);
 void	busdma_swi(void);
 bool	cpu_mwait_usable(void);

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201610272123.u9RLNENb079520>