Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix problems in many d_mmap routines: 

- returned EOPNOTSUPP rather than -1.
	- no check for negative offset.
many of these fix potential security problems in these drivers.


XXX XXX XXX
the d_mmap cdev routine should be changed to have a prototype like:
	paddr_t (*d_mmap) __P((dev_t, off_t, int));

by someone!
This commit is contained in:
mrg 1998-11-19 15:38:20 +00:00
parent db360b9524
commit db3051d720
47 changed files with 138 additions and 108 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sys/arch/alpha/tc/cfb.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: cfb.c,v 1.20 1998/10/22 01:03:08 briggs Exp $ */
/* $NetBSD: cfb.c,v 1.21 1998/11/19 15:38:20 mrg Exp $ */
/*
* Copyright (c) 1995, 1996 Carnegie-Mellon University.
@ -29,7 +29,7 @@
#include <sys/cdefs.h> /* RCS ID & Copyright macro defns */
__KERNEL_RCSID(0, "$NetBSD: cfb.c,v 1.20 1998/10/22 01:03:08 briggs Exp $");
__KERNEL_RCSID(0, "$NetBSD: cfb.c,v 1.21 1998/11/19 15:38:20 mrg Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@ -307,8 +307,8 @@ cfbmmap(v, offset, prot)
{
struct cfb_softc *sc = v;
if (offset > CFB_SIZE)
return -1;
if (offset >= CFB_SIZE || offset < 0)
return (-1);
return alpha_btop(sc->sc_dc->dc_paddr + offset);
}

8
sys/arch/alpha/tc/sfb.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: sfb.c,v 1.20 1998/10/22 01:03:08 briggs Exp $ */
/* $NetBSD: sfb.c,v 1.21 1998/11/19 15:38:20 mrg Exp $ */
/*
* Copyright (c) 1995, 1996 Carnegie-Mellon University.
@ -29,7 +29,7 @@
#include <sys/cdefs.h> /* RCS ID & Copyright macro defns */
__KERNEL_RCSID(0, "$NetBSD: sfb.c,v 1.20 1998/10/22 01:03:08 briggs Exp $");
__KERNEL_RCSID(0, "$NetBSD: sfb.c,v 1.21 1998/11/19 15:38:20 mrg Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@ -437,8 +437,8 @@ sfbmmap(v, offset, prot)
{
struct sfb_softc *sc = v;
if (offset > SFB_SIZE)
return -1;
if (offset >= SFB_SIZE || offset < 0)
return (-1);
return alpha_btop(sc->sc_dc->dc_paddr + offset);
}

6
sys/arch/alpha/wscons/wscons.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: wscons.c,v 1.17 1998/03/21 22:52:59 mycroft Exp $ */
/* $NetBSD: wscons.c,v 1.18 1998/11/19 15:38:21 mrg Exp $ */
/*
* Copyright (c) 1995, 1996 Carnegie-Mellon University.
@ -29,7 +29,7 @@
#include <sys/cdefs.h> /* RCS ID & Copyright macro defns */
__KERNEL_RCSID(0, "$NetBSD: wscons.c,v 1.17 1998/03/21 22:52:59 mycroft Exp $");
__KERNEL_RCSID(0, "$NetBSD: wscons.c,v 1.18 1998/11/19 15:38:21 mrg Exp $");
#include <sys/param.h>
#include <sys/device.h>
@ -375,7 +375,7 @@ wsconsmmap(dev, offset, prot)
{
struct wscons_softc *sc = wscons_cd.cd_devs[WSCUNIT(dev)];
if (sc->sc_ioctl != NULL)
if (sc->sc_ioctl != NULL && offset >= 0)
return (*sc->sc_mmap)(sc->sc_dev.dv_parent, offset, prot);
else
return -1;

4
sys/arch/amiga/amiga/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.20 1998/07/10 20:24:34 mhitch Exp $ */
/* $NetBSD: mem.c,v 1.21 1998/11/19 15:38:21 mrg Exp $ */
/*
* Copyright (c) 1988 University of Utah.
@ -245,5 +245,5 @@ mmmmap(dev, off, prot)
int off, prot;
{
return (EOPNOTSUPP);
return (-1);
}

4
sys/arch/arm32/arm32/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.6 1998/06/02 20:41:50 mark Exp $ */
/* $NetBSD: mem.c,v 1.7 1998/11/19 15:38:21 mrg Exp $ */
/*
* Copyright (c) 1988 University of Utah.
@ -209,7 +209,7 @@ mmmmap(dev, off, prot)
/* minor device 0 is physical memory */
if (off > ctob(physmem) &&
if ((unsigned)off >= ctob(physmem) &&
suser(p->p_ucred, &p->p_acflag) != 0)
return -1;
return arm_byte_to_page(off);

4
sys/arch/arm32/ofw/ofrom.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: ofrom.c,v 1.4 1998/07/07 00:48:12 mark Exp $ */
/* $NetBSD: ofrom.c,v 1.5 1998/11/19 15:38:21 mrg Exp $ */
/*
* Copyright 1998
@ -213,7 +213,7 @@ ofrommmap(dev, off, prot)
if (!sc || !sc->enabled)
return (-1); /* XXX PANIC */
if (off >= sc->size)
if ((u_int)off >= sc->size)
return (-1);
return arm_byte_to_page(sc->base + off);

5
sys/arch/arm32/shark/pccons.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: pccons.c,v 1.6 1998/10/18 12:21:51 mellon Exp $ */
/* $NetBSD: pccons.c,v 1.7 1998/11/19 15:38:21 mrg Exp $ */
/*
* Copyright 1997
@ -3338,6 +3338,9 @@ pcmmap(dev_t dev,
#ifdef SHARK
vm_offset_t pam_io_data, vam_mem_data;
if (offset < 0)
return (-1);
if(offset >> 24 == displayInfo(paddr) >> 24)
{
/* Display memory - allow any address since we

4
sys/arch/arm32/vidc/console/vidcconsole.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: vidcconsole.c,v 1.18 1998/06/02 20:41:57 mark Exp $ */
/* $NetBSD: vidcconsole.c,v 1.19 1998/11/19 15:38:21 mrg Exp $ */
/*
* Copyright (c) 1996 Mark Brinicombe
@ -813,7 +813,7 @@ vidcconsole_mmap(vc, offset, nprot)
int offset;
int nprot;
{
if (offset > videomemory.vidm_size)
if ((u_int)offset >= videomemory.vidm_size)
return (-1);
return(arm_byte_to_page(((videomemory.vidm_pbase) + (offset))));
}

4
sys/arch/atari/atari/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.11 1998/09/02 14:58:02 leo Exp $ */
/* $NetBSD: mem.c,v 1.12 1998/11/19 15:38:22 mrg Exp $ */
/*
* Copyright (c) 1988 University of Utah.
@ -216,5 +216,5 @@ mmmmap(dev, off, prot)
int off, prot;
{
return (EOPNOTSUPP);
return (-1);
}

4
sys/arch/bebox/isa/pccons.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: pccons.c,v 1.13 1998/08/15 04:49:48 mycroft Exp $ */
/* $NetBSD: pccons.c,v 1.14 1998/11/19 15:38:22 mrg Exp $ */
/*-
* Copyright (c) 1998 The NetBSD Foundation, Inc.
@ -2364,7 +2364,7 @@ pcmmap(dev, offset, nprot)
int nprot;
{
if (offset > 0x20000)
if ((u_int)offset >= 0x20000)
return (-1);
return ((int)ISA_MEM(0xa0000 + offset));
}

6
sys/arch/hp300/hp300/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.20 1998/08/20 08:33:44 kleink Exp $ */
/* $NetBSD: mem.c,v 1.21 1998/11/19 15:38:22 mrg Exp $ */
/*
* Copyright (c) 1988 University of Utah.
@ -237,7 +237,7 @@ mmmmap(dev, off, prot)
/*
* Allow access only in RAM.
*/
if ((unsigned)off < lowram || (unsigned)off >= 0xFFFFFFFC)
if ((u_int)off < lowram || (u_int)off >= 0xFFFFFFFC)
return (-1);
return (m68k_btop(off));
return (m68k_btop((u_int)off));
}

8
sys/arch/i386/i386/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.37 1998/08/13 21:36:03 thorpej Exp $ */
/* $NetBSD: mem.c,v 1.38 1998/11/19 15:38:22 mrg Exp $ */
/*
* Copyright (c) 1988 University of Utah.
@ -222,10 +222,10 @@ mmmmap(dev, off, prot)
switch (minor(dev)) {
/* minor device 0 is physical memory */
case 0:
if (off > ctob(physmem) &&
if ((u_int)off > ctob(physmem) &&
suser(p->p_ucred, &p->p_acflag) != 0)
return -1;
return i386_btop(off);
return i386_btop((u_int)off);
/* minor device 1 is kernel memory */
case 1:
@ -237,7 +237,7 @@ mmmmap(dev, off, prot)
if (!kernacc((caddr_t)off, NBPG, B_READ))
return -1;
#endif
return i386_btop(vtophys(off));
return i386_btop(vtophys((u_int)off));
default:
return -1;

2
sys/arch/i386/isa/pcvt/pcvt_drv.c
View File

@ -534,7 +534,7 @@ do_standard:
int
pcmmap(Dev_t dev, int offset, int nprot)
{
if (offset > 0x20000)
if ((u_int)offset >= 0x20000)
return -1;
return i386_btop((0xa0000 + offset));
}

4
sys/arch/mac68k/dev/grf.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: grf.c,v 1.56 1998/10/11 23:21:00 chuck Exp $ */
/* $NetBSD: grf.c,v 1.57 1998/11/19 15:38:22 mrg Exp $ */
/*
* Copyright (c) 1988 University of Utah.
@ -298,7 +298,7 @@ grfmmap(dev, off, prot)
printf("grfmmap(%x): off %x, prot %x\n", dev, off, prot);
#endif
if (off < m68k_round_page(gm->fbsize + gm->fboff))
if (off >= 0 && off < m68k_round_page(gm->fbsize + gm->fboff))
addr = m68k_btop(gp->sc_phys + off);
else
addr = (-1); /* XXX bogus */

6
sys/arch/mac68k/mac68k/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.16 1998/11/10 07:29:59 scottr Exp $ */
/* $NetBSD: mem.c,v 1.17 1998/11/19 15:38:23 mrg Exp $ */
/*
* Copyright (c) 1988 University of Utah.
@ -226,8 +226,8 @@ mmmmap(dev, off, prot)
/*
* Only allow access to physical RAM.
*/
if ((unsigned)off >= maxaddr)
if ((u_int)off >= maxaddr)
return (-1);
return (m68k_btop(off));
return (m68k_btop((u_int)off));
}

4
sys/arch/mac68k/obio/asc.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: asc.c,v 1.28 1998/08/15 07:42:50 scottr Exp $ */
/* $NetBSD: asc.c,v 1.29 1998/11/19 15:38:23 mrg Exp $ */
/*
* Copyright (C) 1997 Scott Reynolds
@ -288,7 +288,7 @@ ascmmap(dev, off, prot)
vm_offset_t pa;
sc = asc_cd.cd_devs[unit];
if (off < MAC68K_ASC_LEN) {
if ((u_int)off < MAC68K_ASC_LEN) {
pa = pmap_extract(pmap_kernel(), (vm_offset_t)sc->sc_handle);
return m68k_btop(pa + off);
}

4
sys/arch/macppc/dev/nvram.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: nvram.c,v 1.1 1998/07/03 11:50:32 tsubai Exp $ */
/* $NetBSD: nvram.c,v 1.2 1998/11/19 15:38:23 mrg Exp $ */
/*-
* Copyright (C) 1998 Internet Research Institute, Inc.
@ -216,5 +216,5 @@ nvrammmap(dev, off, prot)
dev_t dev;
int off, prot;
{
return EOPNOTSUPP;
return -1;
}

4
sys/arch/macppc/dev/ofb.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: ofb.c,v 1.3 1998/10/15 14:48:47 tsubai Exp $ */
/* $NetBSD: ofb.c,v 1.4 1998/11/19 15:38:23 mrg Exp $ */
/*
* Copyright (c) 1995, 1996 Carnegie-Mellon University.
@ -315,7 +315,7 @@ ofb_mmap(v, offset, prot)
struct ofb_softc *sc = v;
struct ofb_devconfig *dc = sc->sc_dc;
if (offset > (dc->dc_linebytes * dc->dc_height))
if (offset >= (dc->dc_linebytes * dc->dc_height) || offset < 0)
return -1;
return dc->dc_paddr + offset;

4
sys/arch/mips/mips/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.13 1998/05/07 21:01:42 kleink Exp $ */
/* $NetBSD: mem.c,v 1.14 1998/11/19 15:38:23 mrg Exp $ */
/*
* Copyright (c) 1988 University of Utah.
@ -181,5 +181,5 @@ mmmmap(dev, off, prot)
int off, prot;
{
return (EOPNOTSUPP);
return (-1);
}

6
sys/arch/mvme68k/mvme68k/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.5 1998/08/22 10:55:35 scw Exp $ */
/* $NetBSD: mem.c,v 1.6 1998/11/19 15:38:23 mrg Exp $ */
/*
* Copyright (c) 1988 University of Utah.
@ -228,7 +228,7 @@ mmmmap(dev, off, prot)
* XXX could be extended to allow access to IO space but must
* be very careful.
*/
if ((unsigned)off < lowram || (unsigned)off >= 0xFFFFFFFC)
if ((u_int)off < lowram || (u_int)off >= 0xFFFFFFFC)
return (-1);
return (m68k_btop(off));
return (m68k_btop((u_int)off));
}

6
sys/arch/next68k/next68k/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.2 1998/11/10 22:45:45 dbj Exp $ */
/* $NetBSD: mem.c,v 1.3 1998/11/19 15:38:23 mrg Exp $ */
/*
* This file was taken from from mvme68k/mvme68k/mem.c
@ -235,7 +235,7 @@ mmmmap(dev, off, prot)
* XXX could be extended to allow access to IO space but must
* be very careful.
*/
if ((unsigned)off < lowram || (unsigned)off >= 0xFFFFFFFC)
if ((u_int)off < lowram || (u_int)off >= 0xFFFFFFFC)
return (-1);
return (m68k_btop(off));
return (m68k_btop((u_int)off));
}

8
sys/arch/pc532/pc532/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.18 1998/09/12 19:14:59 matthias Exp $ */
/* $NetBSD: mem.c,v 1.19 1998/11/19 15:38:23 mrg Exp $ */
/*
* Copyright (c) 1988 University of Utah.
@ -204,10 +204,10 @@ mmmmap(dev, off, prot)
switch (minor(dev)) {
/* minor device 0 is physical memory */
case 0:
if (off > ctob(physmem) &&
if ((u_int)off > ctob(physmem) &&
suser(p->p_ucred, &p->p_acflag) != 0)
return -1;
return ns532_btop(off);
return ns532_btop((u_int)off);
/* minor device 1 is kernel memory */
case 1:
@ -219,7 +219,7 @@ mmmmap(dev, off, prot)
if (!kernacc((caddr_t)off, NBPG, B_READ))
return -1;
#endif
return ns532_btop(vtophys(off));
return ns532_btop(vtophys((u_int)off));
default:
return -1;

5
sys/arch/pmax/dev/fb_usrreq.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: fb_usrreq.c,v 1.11 1998/01/05 07:03:10 perry Exp $ */
/* $NetBSD: fb_usrreq.c,v 1.12 1998/11/19 15:38:23 mrg Exp $ */
/*ARGSUSED*/
int
@ -244,6 +244,9 @@ fbmmap(dev, off, prot)
int len;
register struct fbinfo *fi;
if (off < 0)
return (-1);
if (minor(dev) >= fbcd.cd_ndevs ||
(fi = fbcd.cd_devs[minor(dev)]) == NULL)
return(-1);

5
sys/arch/pmax/dev/rcons.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: rcons.c,v 1.17 1998/11/16 00:10:39 jonathan Exp $ */
/* $NetBSD: rcons.c,v 1.18 1998/11/19 15:38:23 mrg Exp $ */
/*
* Copyright (c) 1995
@ -395,7 +395,8 @@ rconsmmap (dev, off, prot)
int off;
int prot;
{
return 0;
return -1;
}

4
sys/arch/powerpc/powerpc/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.3 1998/08/31 14:43:40 tsubai Exp $ */
/* $NetBSD: mem.c,v 1.4 1998/11/19 15:38:24 mrg Exp $ */
/*
* Copyright (c) 1988 University of Utah.
@ -150,5 +150,5 @@ mmmmap(dev, off, prot)
dev_t dev;
int off, prot;
{
return EOPNOTSUPP;
return -1;
}

8
sys/arch/sparc/dev/cgeight.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: cgeight.c,v 1.18 1998/04/07 20:18:18 pk Exp $ */
/* $NetBSD: cgeight.c,v 1.19 1998/11/19 15:38:24 mrg Exp $ */
/*-
* Copyright (c) 1996, 1997 The NetBSD Foundation, Inc.
@ -441,7 +441,9 @@ cgeightmmap(dev, off, prot)
if (off & PGOFSET)
panic("cgeightmap");
if ((u_int)off >= NOOVERLAY) {
if (off < 0)
return (-1);
else if ((u_int)off >= NOOVERLAY) {
off -= NOOVERLAY;
/*
@ -449,7 +451,7 @@ cgeightmmap(dev, off, prot)
* there really is. We compensate by double-mapping the
* first page for as many other pages as it wants
*/
while (off >= COLOR_SIZE)
while ((u_int)off >= COLOR_SIZE)
off -= COLOR_SIZE; /* XXX thorpej ??? */
poff = off + PFOUR_COLOR_OFF_COLOR;

8
sys/arch/sparc/dev/cgfour.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: cgfour.c,v 1.18 1998/04/07 20:18:18 pk Exp $ */
/* $NetBSD: cgfour.c,v 1.19 1998/11/19 15:38:24 mrg Exp $ */
/*-
* Copyright (c) 1996, 1997 The NetBSD Foundation, Inc.
@ -439,7 +439,9 @@ cgfourmmap(dev, off, prot)
if (off & PGOFSET)
panic("cgfourmap");
if ((u_int)off >= NOOVERLAY) {
if (off < 0)
return (-1);
else if ((u_int)off >= NOOVERLAY) {
off -= NOOVERLAY;
/*
@ -447,7 +449,7 @@ cgfourmmap(dev, off, prot)
* there really is. We compensate by double-mapping the
* first page for as many other pages as it wants
*/
while (off >= COLOR_SIZE)
while ((u_int)off >= COLOR_SIZE)
off -= COLOR_SIZE; /* XXX thorpej ??? */
poff = off + PFOUR_COLOR_OFF_COLOR;

5
sys/arch/sparc/dev/cgfourteen.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: cgfourteen.c,v 1.13 1998/07/29 18:36:08 pk Exp $ */
/* $NetBSD: cgfourteen.c,v 1.14 1998/11/19 15:38:24 mrg Exp $ */
/*
* Copyright (c) 1996
@ -558,6 +558,9 @@ cgfourteenmmap(dev, off, prot)
if (off & PGOFSET)
panic("cgfourteenmmap");
if (off < 0)
return (-1);
#if defined(DEBUG) && defined(CG14_MAP_REGS) /* XXX: security hole */
/*
* Map the control registers into user space. Should only be

4
sys/arch/sparc/dev/cgthree.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: cgthree.c,v 1.39 1998/09/07 07:15:51 pk Exp $ */
/* $NetBSD: cgthree.c,v 1.40 1998/11/19 15:38:24 mrg Exp $ */
/*-
* Copyright (c) 1998 The NetBSD Foundation, Inc.
@ -569,6 +569,8 @@ cgthreemmap(dev, off, prot)
if (off & PGOFSET)
panic("cgthreemmap");
if (off < 0)
return (-1);
if ((u_int)off >= NOOVERLAY)
off -= NOOVERLAY;
else if ((u_int)off >= START)

8
sys/arch/sparc64/dev/cgeight.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: cgeight.c,v 1.2 1998/08/13 02:10:40 eeh Exp $ */
/* $NetBSD: cgeight.c,v 1.3 1998/11/19 15:38:24 mrg Exp $ */
/*
* Copyright (c) 1996 Jason R. Thorpe. All rights reserved.
@ -414,7 +414,9 @@ cgeightmmap(dev, off, prot)
if (off & PGOFSET)
panic("cgeightmap");
if ((u_int)off >= NOOVERLAY) {
if (off < 0)
return (-1);
else if ((u_int)off >= NOOVERLAY) {
off -= NOOVERLAY;
/*
@ -422,7 +424,7 @@ cgeightmmap(dev, off, prot)
* there really is. We compensate by double-mapping the
* first page for as many other pages as it wants
*/
while (off >= COLOR_SIZE)
while ((u_int)off >= COLOR_SIZE)
off -= COLOR_SIZE; /* XXX thorpej ??? */
poff = off + PFOUR_COLOR_OFF_COLOR;

8
sys/arch/sparc64/dev/cgfour.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: cgfour.c,v 1.2 1998/08/13 02:10:41 eeh Exp $ */
/* $NetBSD: cgfour.c,v 1.3 1998/11/19 15:38:24 mrg Exp $ */
/*
* Copyright (c) 1996 Jason R. Thorpe. All rights reserved.
@ -412,7 +412,9 @@ cgfourmmap(dev, off, prot)
if (off & PGOFSET)
panic("cgfourmap");
if ((u_int)off >= NOOVERLAY) {
if (off < 0)
return (-1);
else if ((u_int)off >= NOOVERLAY) {
off -= NOOVERLAY;
/*
@ -420,7 +422,7 @@ cgfourmmap(dev, off, prot)
* there really is. We compensate by double-mapping the
* first page for as many other pages as it wants
*/
while (off >= COLOR_SIZE)
while ((u_int)off >= COLOR_SIZE)
off -= COLOR_SIZE; /* XXX thorpej ??? */
poff = off + PFOUR_COLOR_OFF_COLOR;

5
sys/arch/sparc64/dev/cgfourteen.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: cgfourteen.c,v 1.2 1998/08/13 02:10:41 eeh Exp $ */
/* $NetBSD: cgfourteen.c,v 1.3 1998/11/19 15:38:24 mrg Exp $ */
/*
* Copyright (c) 1996
@ -583,6 +583,9 @@ cgfourteenmmap(dev, off, prot)
if (off & PGOFSET)
panic("cgfourteenmmap");
if (off < 0)
return (-1);
#if defined(DEBUG) && defined(CG14_MAP_REGS) /* XXX: security hole */
/*
* Map the control registers into user space. Should only be

4
sys/arch/sparc64/dev/cgthree.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: cgthree.c,v 1.3 1998/09/05 16:50:37 pk Exp $ */
/* $NetBSD: cgthree.c,v 1.4 1998/11/19 15:38:24 mrg Exp $ */
/*
* Copyright (c) 1992, 1993
@ -436,6 +436,8 @@ cgthreemmap(dev, off, prot)
#define START (128*1024 + 128*1024)
#define NOOVERLAY (0x04000000)
if (off < 0)
return (-1);
if (off & PGOFSET)
panic("cgthreemmap");
if ((u_int)off >= NOOVERLAY)

4
sys/arch/sun3/sun3/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.28 1998/06/08 20:47:46 gwr Exp $ */
/* $NetBSD: mem.c,v 1.29 1998/11/19 15:38:24 mrg Exp $ */
/*
* Copyright (c) 1994, 1995 Gordon W. Ross
@ -257,7 +257,7 @@ mmmmap(dev, off, prot)
dev_t dev;
int off, prot;
{
register int v = off;
register u_int v = off;
/*
* Check address validity.

4
sys/arch/sun3/sun3x/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.9 1998/06/09 20:47:18 gwr Exp $ */
/* $NetBSD: mem.c,v 1.10 1998/11/19 15:38:24 mrg Exp $ */
/*
* Copyright (c) 1988 University of Utah.
@ -246,7 +246,7 @@ mmmmap(dev, off, prot)
dev_t dev;
int off, prot;
{
register int v = off;
register u_int v = off;
/*
* Check address validity.

4
sys/arch/vax/vax/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.12 1998/05/07 21:01:43 kleink Exp $ */
/* $NetBSD: mem.c,v 1.13 1998/11/19 15:38:24 mrg Exp $ */
/*
* Copyright (c) 1988 University of Utah.
@ -173,5 +173,5 @@ mmmmap(dev, off, prot)
int off, prot;
{
return (EOPNOTSUPP);
return (-1);
}

4
sys/arch/vax/vsa/smg.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: smg.c,v 1.8 1998/08/10 14:47:16 ragge Exp $ */
/* $NetBSD: smg.c,v 1.9 1998/11/19 15:38:25 mrg Exp $ */
/*
* Copyright (c) 1998 Ludd, University of Lule}, Sweden.
* All rights reserved.
@ -377,7 +377,7 @@ smg_mmap(v, offset, prot)
off_t offset;
int prot;
{
if (offset > SMSIZE)
if (offset >= SMSIZE || offset < 0)
return -1;
return (SMADDR + offset) >> CLSHIFT;
}

6
sys/arch/x68k/x68k/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.11 1998/08/22 14:38:39 minoura Exp $ */
/* $NetBSD: mem.c,v 1.12 1998/11/19 15:38:25 mrg Exp $ */
/*
* Copyright (c) 1988 University of Utah.
@ -235,7 +235,7 @@ mmmmap(dev, off, prot)
* XXX could be extended to allow access to IO space but must
* be very careful.
*/
if ((unsigned)off < lowram || (unsigned)off >= 0xFFFFFFFC)
if ((u_int)off < lowram || (u_int)off >= 0xFFFFFFFC)
return (-1);
return (m68k_btop(off));
return (m68k_btop((u_int)off));
}

4
sys/dev/audio.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: audio.c,v 1.105 1998/09/27 16:43:56 christos Exp $ */
/* $NetBSD: audio.c,v 1.106 1998/11/19 15:38:25 mrg Exp $ */
/*
* Copyright (c) 1991-1993 Regents of the University of California.
@ -1617,7 +1617,7 @@ audio_mmap(dev, off, prot)
cb = &sc->sc_pr;
#endif
if (off >= cb->bufsize)
if ((u_int)off >= cb->bufsize)
return -1;
if (!cb->mmapped) {
cb->mmapped = 1;

5
sys/dev/isa/isadma.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: isadma.c,v 1.38 1998/07/08 05:23:23 thorpej Exp $ */
/* $NetBSD: isadma.c,v 1.39 1998/11/19 15:38:25 mrg Exp $ */
/*-
* Copyright (c) 1997, 1998 The NetBSD Foundation, Inc.
@ -688,6 +688,9 @@ _isa_dmamem_mmap(ids, chan, addr, size, off, prot, flags)
panic("_isa_dmamem_mmap");
}
if (off < 0)
return (-1);
seg.ds_addr = addr;
seg.ds_len = size;

4
sys/dev/pci/eap.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: eap.c,v 1.17 1998/08/25 04:56:01 thorpej Exp $ */
/* $NetBSD: eap.c,v 1.18 1998/11/19 15:38:25 mrg Exp $ */
/*
* Copyright (c) 1998 The NetBSD Foundation, Inc.
@ -1315,6 +1315,8 @@ eap_mappage(addr, mem, off, prot)
struct eap_softc *sc = addr;
struct eap_dma *p;
if (off < 0)
return (-1);
for (p = sc->sc_dmas; p && KERNADDR(p) != mem; p = p->next)
;
if (!p)

4
sys/dev/pci/tga.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: tga.c,v 1.9 1998/09/02 19:51:06 drochner Exp $ */
/* $NetBSD: tga.c,v 1.10 1998/11/19 15:38:25 mrg Exp $ */
/*
* Copyright (c) 1995, 1996 Carnegie-Mellon University.
@ -429,7 +429,7 @@ tga_mmap(v, offset, prot)
#ifdef __alpha__
struct tga_softc *sc = v;
if (offset > sc->sc_dc->dc_tgaconf->tgac_cspace_size)
if (offset >= sc->sc_dc->dc_tgaconf->tgac_cspace_size || offset < 0)
return -1;
return alpha_btop(sc->sc_dc->dc_paddr + offset);
#else

6
sys/dev/tc/cfb.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: cfb.c,v 1.4 1998/11/18 12:26:31 nisimura Exp $ */
/* $NetBSD: cfb.c,v 1.5 1998/11/19 15:38:25 mrg Exp $ */
/*
* Copyright (c) 1998 Tohru Nishimura. All rights reserved.
@ -32,7 +32,7 @@
#include <sys/cdefs.h> /* RCS ID & Copyright macro defns */
__KERNEL_RCSID(0, "$NetBSD: cfb.c,v 1.4 1998/11/18 12:26:31 nisimura Exp $");
__KERNEL_RCSID(0, "$NetBSD: cfb.c,v 1.5 1998/11/19 15:38:25 mrg Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@ -448,7 +448,7 @@ cfbmmap(v, offset, prot)
{
struct cfb_softc *sc = v;
if (offset > CX_FB_SIZE)
if (offset >= CX_FB_SIZE || offset < 0)
return (-1);
return machine_btop(sc->sc_dc->dc_paddr + offset);
}

6
sys/dev/tc/mfb.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mfb.c,v 1.4 1998/11/18 12:26:32 nisimura Exp $ */
/* $NetBSD: mfb.c,v 1.5 1998/11/19 15:38:25 mrg Exp $ */
/*
* Copyright (c) 1998 Tohru Nishimura. All rights reserved.
@ -32,7 +32,7 @@
#include <sys/cdefs.h> /* RCS ID & Copyright macro defns */
__KERNEL_RCSID(0, "$NetBSD: mfb.c,v 1.4 1998/11/18 12:26:32 nisimura Exp $");
__KERNEL_RCSID(0, "$NetBSD: mfb.c,v 1.5 1998/11/19 15:38:25 mrg Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@ -463,7 +463,7 @@ mfbmmap(v, offset, prot)
{
struct mfb_softc *sc = v;
if (offset > MX_FB_SIZE)
if (offset >= MX_FB_SIZE || offset < 0)
return (-1);
return machine_btop(sc->sc_dc->dc_paddr + offset);
}

6
sys/dev/tc/sfb.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: sfb.c,v 1.5 1998/11/18 12:26:32 nisimura Exp $ */
/* $NetBSD: sfb.c,v 1.6 1998/11/19 15:38:26 mrg Exp $ */
/*
* Copyright (c) 1998 Tohru Nishimura. All rights reserved.
@ -32,7 +32,7 @@
#include <sys/cdefs.h> /* RCS ID & Copyright macro defns */
__KERNEL_RCSID(0, "$NetBSD: sfb.c,v 1.5 1998/11/18 12:26:32 nisimura Exp $");
__KERNEL_RCSID(0, "$NetBSD: sfb.c,v 1.6 1998/11/19 15:38:26 mrg Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@ -450,7 +450,7 @@ sfbmmap(v, offset, prot)
{
struct sfb_softc *sc = v;
if (offset > 0x1000000) /* XXX */
if (offset >= 0x1000000 || offset < 0)
return (-1);
return machine_btop(sc->sc_dc->dc_paddr + offset);
}

6
sys/dev/tc/tfb.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: tfb.c,v 1.4 1998/11/18 12:26:32 nisimura Exp $ */
/* $NetBSD: tfb.c,v 1.5 1998/11/19 15:38:26 mrg Exp $ */
/*
* Copyright (c) 1998 Tohru Nishimura. All rights reserved.
@ -32,7 +32,7 @@
#include <sys/cdefs.h> /* RCS ID & Copyright macro defns */
__KERNEL_RCSID(0, "$NetBSD: tfb.c,v 1.4 1998/11/18 12:26:32 nisimura Exp $");
__KERNEL_RCSID(0, "$NetBSD: tfb.c,v 1.5 1998/11/19 15:38:26 mrg Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@ -486,7 +486,7 @@ tfbmmap(v, offset, prot)
{
struct tfb_softc *sc = v;
if (offset > TX_8FB_SIZE) /* XXX */
if (offset >= TX_8FB_SIZE || offset < 0)
return (-1);
return machine_btop(sc->sc_dc->dc_paddr + TX_8FB_OFFSET + offset);
}

6
sys/dev/tc/xcfb.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: xcfb.c,v 1.4 1998/11/19 06:52:49 nisimura Exp $ */
/* $NetBSD: xcfb.c,v 1.5 1998/11/19 15:38:26 mrg Exp $ */
/*
* Copyright (c) 1998 Tohru Nishimura. All rights reserved.
@ -32,7 +32,7 @@
#include <sys/cdefs.h> /* RCS ID & Copyright macro defns */
__KERNEL_RCSID(0, "$NetBSD: xcfb.c,v 1.4 1998/11/19 06:52:49 nisimura Exp $");
__KERNEL_RCSID(0, "$NetBSD: xcfb.c,v 1.5 1998/11/19 15:38:26 mrg Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@ -402,7 +402,7 @@ xcfbmmap(v, offset, prot)
{
struct xcfb_softc *sc = v;
if (offset > XCFB_FB_SIZE)
if (offset >= XCFB_FB_SIZE || offset < 0)
return -1;
return mips_btop(sc->sc_dc->dc_paddr + offset);
}