Fix mmap security hole from NetBSD. Change the prototype of mmap

system call so all insecure drivers no longer compile (at the request
of bde).

Reviewed by: bde

9 files changed, 14 insertions, 14 deletions

diff --git a/sys/i386/i386/mem.c b/sys/i386/i386/mem.c
index 4d0c0d3f21b3..096ea4651d2f 100644
--- a/sys/i386/i386/mem.c
+++ b/sys/i386/i386/mem.c
@@ -38,7 +38,7 @@
  *
  *	from: Utah $Hdr: mem.c 1.13 89/10/08$
  *	from: @(#)mem.c	7.2 (Berkeley) 5/9/91
- *	$Id: mem.c,v 1.38.2.1 1997/10/23 22:14:24 alex Exp $
+ *	$Id: mem.c,v 1.38.2.2 1997/10/24 04:38:18 davidg Exp $
  */
 
 /*
@@ -387,7 +387,7 @@ mmrw(dev, uio, flags)
 * instead of going through read/write			*
 \*******************************************************/
 static int
-memmmap(dev_t dev, int offset, int nprot)
+memmmap(dev_t dev, vm_offset_t offset, int nprot)
 {
 	switch (minor(dev))
 	{
diff --git a/sys/i386/isa/pcvt/pcvt_drv.c b/sys/i386/isa/pcvt/pcvt_drv.c
index b4257920fc1a..1b129d9ca0bc 100644
--- a/sys/i386/isa/pcvt/pcvt_drv.c
+++ b/sys/i386/isa/pcvt/pcvt_drv.c
@@ -764,7 +764,7 @@ do_standard:
 }
 
 int
-pcmmap(Dev_t dev, int offset, int nprot)
+pcmmap(Dev_t dev, vm_offset_t offset, int nprot)
 {
 	if (offset > 0x20000 - PAGE_SIZE)
 		return -1;
diff --git a/sys/i386/isa/snd/sound.c b/sys/i386/isa/snd/sound.c
index 0c39968e1f95..3f4ccb68cc93 100644
--- a/sys/i386/isa/snd/sound.c
+++ b/sys/i386/isa/snd/sound.c
@@ -1243,14 +1243,14 @@ sndselect(dev_t i_dev, int rw, struct proc * p)
 #include <vm/vm_extern.h>
 
 static int
-sndmmap(dev_t dev, int offset, int nprot)
+sndmmap(dev_t dev, vm_offset_t offset, int nprot)
 {
     snddev_info *d = get_snddev_info(dev, NULL);
 
     DEB(printf("sndmmap d 0x%p dev 0x%04x ofs 0x%08x nprot 0x%08x\n",
 	d, dev, offset, nprot));
     
-    if (d == NULL || nprot & PROT_EXEC)
+    if (d == NULL || nprot & PROT_EXEC || offset < 0)
 	return -1 ; /* forbidden */
 
     if (offset >= d->dbuf_out.bufsize && (nprot & PROT_WRITE) )
diff --git a/sys/i386/isa/spigot.c b/sys/i386/isa/spigot.c
index cc383281a876..ca3b385cb959 100644
--- a/sys/i386/isa/spigot.c
+++ b/sys/i386/isa/spigot.c
@@ -258,7 +258,7 @@ struct	spigot_softc	*ss = (struct spigot_softc *)&spigot_softc[unit];
 }
 
 static	int
-spigot_mmap(dev_t dev, int offset, int nprot)
+spigot_mmap(dev_t dev, vm_offset_t offset, int nprot)
 {
 struct	spigot_softc	*ss = (struct spigot_softc *)&spigot_softc[0];
 
diff --git a/sys/i386/isa/syscons.c b/sys/i386/isa/syscons.c
index ed8fce780c4a..00bff9024708 100644
--- a/sys/i386/isa/syscons.c
+++ b/sys/i386/isa/syscons.c
@@ -25,7 +25,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- *  $Id: syscons.c,v 1.182.2.38 1998/11/03 02:39:06 yokota Exp $
+ *  $Id: syscons.c,v 1.182.2.39 1998/11/13 14:00:15 yokota Exp $
  */
 
 #include "sc.h"
@@ -4098,7 +4098,7 @@ next_code:
 }
 
 int
-scmmap(dev_t dev, int offset, int nprot)
+scmmap(dev_t dev, vm_offset_t offset, int nprot)
 {
     if (offset > 0x20000 - PAGE_SIZE)
 	return -1;
diff --git a/sys/kern/subr_xxx.c b/sys/kern/subr_xxx.c
index ab67b98215a0..bf08ef62ce1b 100644
--- a/sys/kern/subr_xxx.c
+++ b/sys/kern/subr_xxx.c
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)subr_xxx.c	8.1 (Berkeley) 6/10/93
- * $Id: subr_xxx.c,v 1.4 1995/09/10 21:35:51 bde Exp $
+ * $Id: subr_xxx.c,v 1.5 1995/11/06 00:35:51 bde Exp $
  */
 
 /*
@@ -161,7 +161,7 @@ noselect(dev, rw, p)
 int
 nommap(dev, offset, nprot)
 	dev_t dev;
-	int offset;
+	vm_offset_t offset;
 	int nprot;
 {
 
diff --git a/sys/pci/brooktree848.c b/sys/pci/brooktree848.c
index 165567cd0381..412c36334066 100644
--- a/sys/pci/brooktree848.c
+++ b/sys/pci/brooktree848.c
@@ -2428,7 +2428,7 @@ common_ioctl( bktr_ptr_t bktr, bt848_ptr_t bt848, int cmd, caddr_t arg )
  * 
  */
 int
-bktr_mmap( dev_t dev, int offset, int nprot )
+bktr_mmap( dev_t dev, vm_offset_t offset, int nprot )
 {
 	int		unit;
 	bktr_ptr_t	bktr;
diff --git a/sys/pci/meteor.c b/sys/pci/meteor.c
index 17b34eaeba52..e9a279432e01 100644
--- a/sys/pci/meteor.c
+++ b/sys/pci/meteor.c
@@ -2058,7 +2058,7 @@ meteor_ioctl(dev_t dev, int cmd, caddr_t arg, int flag, struct proc *pr)
 }
 
 int
-meteor_mmap(dev_t dev, int offset, int nprot)
+meteor_mmap(dev_t dev, vm_offset_t offset, int nprot)
 {
 
 	int	unit;
diff --git a/sys/sys/conf.h b/sys/sys/conf.h
index 4a5043116ead..8b34ae6e02b2 100644
--- a/sys/sys/conf.h
+++ b/sys/sys/conf.h
@@ -36,7 +36,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)conf.h	8.5 (Berkeley) 1/9/95
- * $Id: conf.h,v 1.30 1996/03/11 02:13:32 hsu Exp $
+ * $Id: conf.h,v 1.31 1996/07/23 21:52:43 phk Exp $
  */
 
 #ifndef _SYS_CONF_H_
@@ -66,7 +66,7 @@ typedef void d_stop_t __P((struct tty *tp, int rw));
 typedef int d_reset_t __P((dev_t dev));
 typedef struct tty *d_devtotty_t __P((dev_t dev));
 typedef int d_select_t __P((dev_t dev, int which, struct proc *p));
-typedef int d_mmap_t __P((dev_t dev, int offset, int nprot));
+typedef int d_mmap_t __P((dev_t dev, vm_offset_t offset, int nprot));
 
 typedef int l_open_t __P((dev_t dev, struct tty *tp));
 typedef int l_close_t __P((struct tty *tp, int flag));