openrisc: fix arbitrary kernel memory access via or1k_atomic syscallgrafted

sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.

    l.lwz   r29,0(r4)
    l.lwz   r27,0(r5)
    l.sw    0(r4),r27
    l.sw    0(r5),r29

The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.

A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.

This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.

Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.

[shorne@gmail.com: fix comment style]
Fixes: 9d02a4283e9c ("OpenRISC: Boot code")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>

1 files changed, 134 insertions, 0 deletions

diff --git a/Documentation/networking/index.rst b/Documentation/networking/index.rst
new file mode 100644
index 000000000..44a422ad3
--- /dev/null
+++ b/Documentation/networking/index.rst
@@ -0,0 +1,134 @@
+Networking
+==========
+
+Refer to :ref:`netdev-FAQ` for a guide on netdev development process specifics.
+
+Contents:
+
+.. toctree::
+   :maxdepth: 2
+
+   af_xdp
+   bareudp
+   batman-adv
+   can
+   can_ucan_protocol
+   device_drivers/index
+   diagnostic/index
+   dsa/index
+   devlink/index
+   ethtool-netlink
+   ieee802154
+   iso15765-2
+   j1939
+   kapi
+   msg_zerocopy
+   failover
+   net_dim
+   net_failover
+   page_pool
+   phy
+   sfp-phylink
+   alias
+   bridge
+   snmp_counter
+   checksum-offloads
+   segmentation-offloads
+   scaling
+   tls
+   tls-offload
+   tls-handshake
+   nfc
+   6lowpan
+   arcnet-hardware
+   arcnet
+   atm
+   bonding
+   cdc_mbim
+   dctcp
+   devmem
+   dns_resolver
+   driver
+   eql
+   fib_trie
+   filter
+   generic-hdlc
+   generic_netlink
+   ../netlink/specs/index
+   gen_stats
+   gtp
+   ila
+   ioam6-sysctl
+   iou-zcrx
+   ip_dynaddr
+   ipsec
+   ip-sysctl
+   ipv6
+   ipvlan
+   ipvs-sysctl
+   kcm
+   l2tp
+   lapb-module
+   mac80211-injection
+   mctp
+   mpls-sysctl
+   mptcp
+   mptcp-sysctl
+   multiqueue
+   multi-pf-netdev
+   napi
+   net_cachelines/index
+   netconsole
+   netdev-features
+   netdevices
+   netfilter-sysctl
+   netif-msg
+   netmem
+   nexthop-group-resilient
+   nf_conntrack-sysctl
+   nf_flowtable
+   oa-tc6-framework
+   openvswitch
+   operstates
+   packet_mmap
+   phonet
+   phy-link-topology
+   phy-port
+   pktgen
+   plip
+   ppp_generic
+   proc_net_tcp
+   pse-pd/index
+   psp
+   radiotap-headers
+   rds
+   regulatory
+   representors
+   rxrpc
+   sctp
+   secid
+   seg6-sysctl
+   skbuff
+   smc-sysctl
+   sriov
+   statistics
+   strparser
+   switchdev
+   sysfs-tagging
+   tc-actions-env-rules
+   tc-queue-filters
+   tcp_ao
+   tcp-thin
+   team
+   timestamping
+   tipc
+   tproxy
+   tuntap
+   udplite
+   vrf
+   vxlan
+   x25
+   x25-iface
+   xfrm/index
+   xdp-rx-metadata
+   xsk-tx-metadata