openrisc: fix arbitrary kernel memory access via or1k_atomic syscallgrafted

sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.

    l.lwz   r29,0(r4)
    l.lwz   r27,0(r5)
    l.sw    0(r4),r27
    l.sw    0(r5),r29

The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.

A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.

This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.

Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.

[shorne@gmail.com: fix comment style]
Fixes: 9d02a4283e9c ("OpenRISC: Boot code")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>

1 files changed, 151 insertions, 0 deletions

diff --git a/Documentation/driver-api/index.rst b/Documentation/driver-api/index.rst
new file mode 100644
index 000000000..eaf7161ff
--- /dev/null
+++ b/Documentation/driver-api/index.rst
@@ -0,0 +1,151 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+==============================
+Driver implementer's API guide
+==============================
+
+The kernel offers a wide variety of interfaces to support the development
+of device drivers.  This document is an only somewhat organized collection
+of some of those interfaces — it will hopefully get better over time!  The
+available subsections can be seen below.
+
+
+General information for driver authors
+======================================
+
+This section contains documentation that should, at some point or other, be
+of interest to most developers working on device drivers.
+
+.. toctree::
+   :maxdepth: 1
+
+   basics
+   driver-model/index
+   device_link
+   infrastructure
+   ioctl
+   pm/index
+
+Useful support libraries
+========================
+
+This section contains documentation that should, at some point or other, be
+of interest to most developers working on device drivers.
+
+.. toctree::
+   :maxdepth: 1
+
+   early-userspace/index
+   connector
+   device-io
+   devfreq
+   dma-buf
+   component
+   io-mapping
+   io_ordering
+   uio-howto
+   vfio-mediated-device
+   vfio
+   vfio-pci-device-specific-driver-acceptance
+
+Bus-level documentation
+=======================
+
+.. toctree::
+   :maxdepth: 1
+
+   auxiliary_bus
+   cxl/index
+   eisa
+   firewire
+   i3c/index
+   isa
+   men-chameleon-bus
+   pci/index
+   rapidio/index
+   slimbus
+   usb/index
+   virtio/index
+   vme
+   w1
+   xillybus
+
+
+Subsystem-specific APIs
+=======================
+
+.. toctree::
+   :maxdepth: 1
+
+   80211/index
+   acpi/index
+   backlight/lp855x-driver.rst
+   clk
+   coco/index
+   console
+   crypto/index
+   dmaengine/index
+   dpll
+   edac
+   extcon
+   firmware/index
+   fpga/index
+   frame-buffer
+   aperture
+   generic-counter
+   generic_pt
+   gpio/index
+   hsi
+   hte/index
+   hw-recoverable-errors
+   i2c
+   iio/index
+   infiniband
+   input
+   interconnect
+   ipmb
+   ipmi
+   libata
+   mailbox
+   md/index
+   media/index
+   mei/index
+   memory-devices/index
+   message-based
+   misc_devices
+   miscellaneous
+   mmc/index
+   mtd/index
+   mtdnand
+   nfc/index
+   ntb
+   nvdimm/index
+   nvmem
+   parport-lowlevel
+   phy/index
+   pin-control
+   pldmfw/index
+   pps
+   ptp
+   pwm
+   pwrseq
+   regulator
+   reset
+   rfkill
+   s390-drivers
+   scsi
+   serial/index
+   sm501
+   soundwire/index
+   spi
+   surface_aggregator/index
+   switchtec
+   sync_file
+   target
+   tee
+   thermal/index
+   tty/index
+   wbrf
+   wmi
+   xilinx/index
+   zorro