openrisc: fix arbitrary kernel memory access via or1k_atomic syscallgrafted

sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.

    l.lwz   r29,0(r4)
    l.lwz   r27,0(r5)
    l.sw    0(r4),r27
    l.sw    0(r5),r29

The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.

A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.

This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.

Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.

[shorne@gmail.com: fix comment style]
Fixes: 9d02a4283e9c ("OpenRISC: Boot code")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>

1 files changed, 178 insertions, 0 deletions

diff --git a/arch/mips/bcm63xx/setup.c b/arch/mips/bcm63xx/setup.c
new file mode 100644
index 000000000..81529084b
--- /dev/null
+++ b/arch/mips/bcm63xx/setup.c
@@ -0,0 +1,178 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2008 Maxime Bizon <mbizon@freebox.fr>
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/memblock.h>
+#include <linux/ioport.h>
+#include <linux/pm.h>
+#include <asm/bmips.h>
+#include <asm/bootinfo.h>
+#include <asm/time.h>
+#include <asm/reboot.h>
+#include <asm/cacheflush.h>
+#include <bcm63xx_board.h>
+#include <bcm63xx_cpu.h>
+#include <bcm63xx_regs.h>
+#include <bcm63xx_io.h>
+#include <bcm63xx_gpio.h>
+
+/*
+ * CBR addr doesn't change and we can cache it.
+ * For broken SoC/Bootloader CBR addr might also be provided via DT
+ * with "brcm,bmips-cbr-reg" in the "cpus" node.
+ */
+void __iomem *bmips_cbr_addr __read_mostly;
+
+void bcm63xx_machine_halt(void)
+{
+	pr_info("System halted\n");
+	while (1)
+		;
+}
+
+static void bcm6348_a1_reboot(void)
+{
+	u32 reg;
+
+	/* soft reset all blocks */
+	pr_info("soft-resetting all blocks ...\n");
+	reg = bcm_perf_readl(PERF_SOFTRESET_REG);
+	reg &= ~SOFTRESET_6348_ALL;
+	bcm_perf_writel(reg, PERF_SOFTRESET_REG);
+	mdelay(10);
+
+	reg = bcm_perf_readl(PERF_SOFTRESET_REG);
+	reg |= SOFTRESET_6348_ALL;
+	bcm_perf_writel(reg, PERF_SOFTRESET_REG);
+	mdelay(10);
+
+	/* Jump to the power on address. */
+	pr_info("jumping to reset vector.\n");
+	/* set high vectors (base at 0xbfc00000 */
+	set_c0_status(ST0_BEV | ST0_ERL);
+	/* run uncached in kseg0 */
+	change_c0_config(CONF_CM_CMASK, CONF_CM_UNCACHED);
+	__flush_cache_all();
+	/* remove all wired TLB entries */
+	write_c0_wired(0);
+	__asm__ __volatile__(
+		"jr\t%0"
+		:
+		: "r" (0xbfc00000));
+	while (1)
+		;
+}
+
+void bcm63xx_machine_reboot(void)
+{
+	u32 reg, perf_regs[2] = { 0, 0 };
+	unsigned int i;
+
+	/* mask and clear all external irq */
+	switch (bcm63xx_get_cpu_id()) {
+	case BCM3368_CPU_ID:
+		perf_regs[0] = PERF_EXTIRQ_CFG_REG_3368;
+		break;
+	case BCM6328_CPU_ID:
+		perf_regs[0] = PERF_EXTIRQ_CFG_REG_6328;
+		break;
+	case BCM6338_CPU_ID:
+		perf_regs[0] = PERF_EXTIRQ_CFG_REG_6338;
+		break;
+	case BCM6345_CPU_ID:
+		perf_regs[0] = PERF_EXTIRQ_CFG_REG_6345;
+		break;
+	case BCM6348_CPU_ID:
+		perf_regs[0] = PERF_EXTIRQ_CFG_REG_6348;
+		break;
+	case BCM6358_CPU_ID:
+		perf_regs[0] = PERF_EXTIRQ_CFG_REG_6358;
+		break;
+	case BCM6362_CPU_ID:
+		perf_regs[0] = PERF_EXTIRQ_CFG_REG_6362;
+		break;
+	}
+
+	for (i = 0; i < 2; i++) {
+		if (!perf_regs[i])
+			break;
+
+		reg = bcm_perf_readl(perf_regs[i]);
+		if (BCMCPU_IS_6348()) {
+			reg &= ~EXTIRQ_CFG_MASK_ALL_6348;
+			reg |= EXTIRQ_CFG_CLEAR_ALL_6348;
+		} else {
+			reg &= ~EXTIRQ_CFG_MASK_ALL;
+			reg |= EXTIRQ_CFG_CLEAR_ALL;
+		}
+		bcm_perf_writel(reg, perf_regs[i]);
+	}
+
+	if (BCMCPU_IS_6348() && (bcm63xx_get_cpu_rev() == 0xa1))
+		bcm6348_a1_reboot();
+
+	pr_info("triggering watchdog soft-reset...\n");
+	if (BCMCPU_IS_6328()) {
+		bcm_wdt_writel(1, WDT_SOFTRESET_REG);
+	} else {
+		reg = bcm_perf_readl(PERF_SYS_PLL_CTL_REG);
+		reg |= SYS_PLL_SOFT_RESET;
+		bcm_perf_writel(reg, PERF_SYS_PLL_CTL_REG);
+	}
+	while (1)
+		;
+}
+
+static void __bcm63xx_machine_reboot(char *p)
+{
+	bcm63xx_machine_reboot();
+}
+
+/*
+ * return system type in /proc/cpuinfo
+ */
+const char *get_system_type(void)
+{
+	static char buf[128];
+	snprintf(buf, sizeof(buf), "bcm63xx/%s (0x%04x/0x%02X)",
+		 board_get_name(),
+		 bcm63xx_get_cpu_id(), bcm63xx_get_cpu_rev());
+	return buf;
+}
+
+void __init plat_time_init(void)
+{
+	mips_hpt_frequency = bcm63xx_get_cpu_freq() / 2;
+}
+
+void __init plat_mem_setup(void)
+{
+	memblock_add(0, bcm63xx_get_memory_size());
+
+	_machine_halt = bcm63xx_machine_halt;
+	_machine_restart = __bcm63xx_machine_reboot;
+	pm_power_off = bcm63xx_machine_halt;
+
+	set_io_port_base(0);
+	ioport_resource.start = 0;
+	ioport_resource.end = ~0;
+
+	board_setup();
+}
+
+static int __init bcm63xx_register_devices(void)
+{
+	/* register gpiochip */
+	bcm63xx_gpio_init();
+
+	return board_register_devices();
+}
+
+arch_initcall(bcm63xx_register_devices);