[PATCH] Fix range check on mmaped sysfs resource files

[PATCH] Fix range check on mmaped sysfs resource files

[Ed Swierk]

[-- Attachment #1: Type: text/plain, Size: 277 bytes --]

pci_mmap_fits() in 2.6.27.4 returns the wrong answer if the sysfs
resource file size is not a multiple of the page size. vm_end and
vm_start are already page-aligned, so size - start < nr, causing
mmap() to return EINVAL.

Signed-off-by: Ed Swierk <eswierk@aristanetworks.com>

[-- Attachment #2: linux-2.6.27-pci-sysfs-mmap-bug.patch --]
[-- Type: application/octet-stream, Size: 607 bytes --]

Index: linux-2.6.27.4/drivers/pci/pci-sysfs.c
===================================================================
--- linux-2.6.27.4.orig/drivers/pci/pci-sysfs.c
+++ linux-2.6.27.4/drivers/pci/pci-sysfs.c
@@ -492,7 +492,7 @@ static int pci_mmap_fits(struct pci_dev 
 
 	nr = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
 	start = vma->vm_pgoff;
-	size = pci_resource_len(pdev, resno) >> PAGE_SHIFT;
+	size = ((pci_resource_len(pdev, resno) - 1) >> PAGE_SHIFT) + 1;
 	if (start < size && size - start >= nr)
 		return 1;
 	WARN(1, "process \"%s\" tried to map 0x%08lx-0x%08lx on %s BAR %d (size 0x%08lx)\n",

Re: [PATCH] Fix range check on mmaped sysfs resource files

[Ed Swierk]

[-- Attachment #1: Type: text/plain, Size: 403 bytes --]

On Tue, 2008-10-28 at 22:24 -0700, Ed Swierk wrote:
> pci_mmap_fits() in 2.6.27.4 returns the wrong answer if the sysfs
> resource file size is not a multiple of the page size. vm_end and
> vm_start are already page-aligned, so size - start < nr, causing
> mmap() to return EINVAL.
> 
> Signed-off-by: Ed Swierk <eswierk@aristanetworks.com>

...and here is the patch in a hopefully more readable form.


[-- Attachment #2: linux-2.6.27-pci-sysfs-mmap-bug.patch --]
[-- Type: text/x-patch, Size: 607 bytes --]

Index: linux-2.6.27.4/drivers/pci/pci-sysfs.c
===================================================================
--- linux-2.6.27.4.orig/drivers/pci/pci-sysfs.c
+++ linux-2.6.27.4/drivers/pci/pci-sysfs.c
@@ -492,7 +492,7 @@ static int pci_mmap_fits(struct pci_dev 
 
 	nr = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
 	start = vma->vm_pgoff;
-	size = pci_resource_len(pdev, resno) >> PAGE_SHIFT;
+	size = ((pci_resource_len(pdev, resno) - 1) >> PAGE_SHIFT) + 1;
 	if (start < size && size - start >= nr)
 		return 1;
 	WARN(1, "process \"%s\" tried to map 0x%08lx-0x%08lx on %s BAR %d (size 0x%08lx)\n",