Stricter range checks in mmap function.

6 files changed, 12 insertions, 12 deletions

diff --git a/sys/arch/aviion/dev/nvram.c b/sys/arch/aviion/dev/nvram.c
index 71ddcb3dea3..767e189d2f1 100644
--- a/sys/arch/aviion/dev/nvram.c
+++ b/sys/arch/aviion/dev/nvram.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nvram.c,v 1.4 2006/07/17 04:21:30 miod Exp $ */
+/*	$OpenBSD: nvram.c,v 1.5 2007/12/20 05:19:35 miod Exp $ */
 
 /*
  * Copyright (c) 1995 Theo de Raadt
@@ -434,7 +434,7 @@ nvrammmap(dev, off, prot)
 		return (-1);
 
 	/* allow access only in RAM */
-	if (off < 0 || off > sc->sc_len)
+	if (off < 0 || off >= round_page(sc->sc_len))
 		return (-1);
 	return (atop(sc->sc_base + off));
 #else
diff --git a/sys/arch/mvme68k/dev/flash.c b/sys/arch/mvme68k/dev/flash.c
index cb870fb182c..63d405e13eb 100644
--- a/sys/arch/mvme68k/dev/flash.c
+++ b/sys/arch/mvme68k/dev/flash.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: flash.c,v 1.17 2005/12/17 07:31:26 miod Exp $ */
+/*	$OpenBSD: flash.c,v 1.18 2007/12/20 05:19:38 miod Exp $ */
 
 /*
  * Copyright (c) 1995 Theo de Raadt
@@ -486,7 +486,7 @@ flashmmap(dev, off, prot)
 	struct flashsoftc *sc = (struct flashsoftc *) flash_cd.cd_devs[unit];
 
 	/* allow access only in RAM */
-	if (off < 0 || off > sc->sc_len)
+	if (off < 0 || off >= round_page(sc->sc_len))
 		return (-1);
 	return (atop(sc->sc_paddr + off));
 }
diff --git a/sys/arch/mvme68k/dev/nvram.c b/sys/arch/mvme68k/dev/nvram.c
index 4672ab6918b..43572b85600 100644
--- a/sys/arch/mvme68k/dev/nvram.c
+++ b/sys/arch/mvme68k/dev/nvram.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nvram.c,v 1.17 2006/06/21 14:49:33 deraadt Exp $ */
+/*	$OpenBSD: nvram.c,v 1.18 2007/12/20 05:19:38 miod Exp $ */
 
 /*
  * Copyright (c) 1995 Theo de Raadt
@@ -415,7 +415,7 @@ nvrammmap(dev, off, prot)
 		return (-1);
 
 	/* allow access only in RAM */
-	if (off < 0 || off > sc->sc_len)
+	if (off < 0 || off >= round_page(sc->sc_len))
 		return (-1);
 	return (atop(sc->sc_paddr + off));
 }
diff --git a/sys/arch/mvme68k/dev/sram.c b/sys/arch/mvme68k/dev/sram.c
index 873e01ccab0..c97251234f7 100644
--- a/sys/arch/mvme68k/dev/sram.c
+++ b/sys/arch/mvme68k/dev/sram.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sram.c,v 1.17 2005/11/25 19:19:39 miod Exp $ */
+/*	$OpenBSD: sram.c,v 1.18 2007/12/20 05:19:38 miod Exp $ */
 
 /*
  * Copyright (c) 1995 Theo de Raadt
@@ -215,7 +215,7 @@ srammmap(dev, off, prot)
 		return (-1);
 
 	/* allow access only in RAM */
-	if (off < 0 || off > sc->sc_len)
+	if (off < 0 || off >= round_page(sc->sc_len))
 		return (-1);
 	return (atop(sc->sc_paddr + off));
 }
diff --git a/sys/arch/mvme88k/dev/nvram.c b/sys/arch/mvme88k/dev/nvram.c
index 25d19415aed..2c81d1f8695 100644
--- a/sys/arch/mvme88k/dev/nvram.c
+++ b/sys/arch/mvme88k/dev/nvram.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nvram.c,v 1.29 2006/06/19 15:13:35 deraadt Exp $ */
+/*	$OpenBSD: nvram.c,v 1.30 2007/12/20 05:19:38 miod Exp $ */
 
 /*
  * Copyright (c) 1995 Theo de Raadt
@@ -539,7 +539,7 @@ nvrammmap(dev, off, prot)
 #endif
 
 	/* allow access only in RAM */
-	if (off < 0 || off > sc->sc_len)
+	if (off < 0 || off >= round_page(sc->sc_len))
 		return (-1);
 	return (atop(sc->sc_base + off));
 }
diff --git a/sys/arch/mvme88k/dev/sram.c b/sys/arch/mvme88k/dev/sram.c
index bc6ea49e4f1..d02aba3aca9 100644
--- a/sys/arch/mvme88k/dev/sram.c
+++ b/sys/arch/mvme88k/dev/sram.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sram.c,v 1.18 2006/04/26 21:09:48 miod Exp $ */
+/*	$OpenBSD: sram.c,v 1.19 2007/12/20 05:19:38 miod Exp $ */
 
 /*
  * Copyright (c) 1995 Theo de Raadt
@@ -171,7 +171,7 @@ srammmap(dev, off, prot)
 		return (-1);
 
 	/* allow access only in RAM */
-	if (off < 0 || off > sc->sc_len)
+	if (off < 0 || off >= round_page(sc->sc_len))
 		return (-1);
 	return (atop(sc->sc_base + off));
 }