openrisc: fix arbitrary kernel memory access via or1k_atomic syscallgrafted

sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.

    l.lwz   r29,0(r4)
    l.lwz   r27,0(r5)
    l.sw    0(r4),r27
    l.sw    0(r5),r29

The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.

A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.

This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.

Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.

[shorne@gmail.com: fix comment style]
Fixes: 9d02a4283e9c ("OpenRISC: Boot code")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>

1 files changed, 204 insertions, 0 deletions

diff --git a/drivers/input/Kconfig b/drivers/input/Kconfig
new file mode 100644
index 000000000..88ecdf521
--- /dev/null
+++ b/drivers/input/Kconfig
@@ -0,0 +1,204 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Input device configuration
+#
+
+menu "Input device support"
+
+config INPUT
+	tristate "Generic input layer (needed for keyboard, mouse, ...)" if EXPERT
+	default y
+	help
+	  Say Y here if you have any input device (mouse, keyboard, tablet,
+	  joystick, steering wheel ...) connected to your system and want
+	  it to be available to applications. This includes standard PS/2
+	  keyboard and mouse.
+
+	  Say N here if you have a headless (no monitor, no keyboard) system.
+
+	  More information is available: <file:Documentation/input/input.rst>
+
+	  If unsure, say Y.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called input.
+
+if INPUT
+
+config INPUT_LEDS
+	tristate "Export input device LEDs in sysfs"
+	depends on LEDS_CLASS
+	default INPUT
+	help
+	  Say Y here if you would like to export LEDs on input devices
+	  as standard LED class devices in sysfs.
+
+	  If unsure, say Y.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called input-leds.
+
+config INPUT_FF_MEMLESS
+	tristate "Support for memoryless force-feedback devices"
+	help
+	  Say Y here if you have memoryless force-feedback input device
+	  such as Logitech WingMan Force 3D, ThrustMaster FireStorm Dual
+	  Power 2, or similar. You will also need to enable hardware-specific
+	  driver.
+
+	  If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called ff-memless.
+
+config INPUT_SPARSEKMAP
+	tristate "Sparse keymap support library"
+	help
+	  Say Y here if you are using a driver for an input
+	  device that uses sparse keymap. This option is only
+	  useful for out-of-tree drivers since in-tree drivers
+	  select it automatically.
+
+	  If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called sparse-keymap.
+
+config INPUT_MATRIXKMAP
+	tristate "Matrix keymap support library"
+	help
+	  Say Y here if you are using a driver for an input
+	  device that uses matrix keymap. This option is only
+	  useful for out-of-tree drivers since in-tree drivers
+	  select it automatically.
+
+	  If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called matrix-keymap.
+
+config INPUT_VIVALDIFMAP
+	tristate
+	help
+	  ChromeOS Vivaldi keymap support library. This is a hidden
+	  option so that drivers can use common code to parse and
+	  expose the vivaldi function row keymap.
+
+comment "Userland interfaces"
+
+config INPUT_MOUSEDEV
+	tristate "Mouse interface"
+	help
+	  Say Y here if you want your mouse to be accessible as char devices
+	  13:32+ - /dev/input/mouseX and 13:63 - /dev/input/mice as an
+	  emulated IntelliMouse Explorer PS/2 mouse. That way, all user space
+	  programs (including SVGAlib, GPM and X) will be able to use your
+	  mouse.
+
+	  If unsure, say Y.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called mousedev.
+
+config INPUT_MOUSEDEV_PSAUX
+	bool "Provide legacy /dev/psaux device"
+	depends on INPUT_MOUSEDEV
+	help
+	  Say Y here if you want your mouse also be accessible as char device
+	  10:1 - /dev/psaux. The data available through /dev/psaux is exactly
+	  the same as the data from /dev/input/mice.
+
+	  If unsure, say Y.
+
+config INPUT_MOUSEDEV_SCREEN_X
+	int "Horizontal screen resolution"
+	depends on INPUT_MOUSEDEV
+	default "1024"
+	help
+	  If you're using a digitizer, or a graphic tablet, and want to use
+	  it as a mouse then the mousedev driver needs to know the X window
+	  screen resolution you are using to correctly scale the data. If
+	  you're not using a digitizer, this value is ignored.
+
+config INPUT_MOUSEDEV_SCREEN_Y
+	int "Vertical screen resolution"
+	depends on INPUT_MOUSEDEV
+	default "768"
+	help
+	  If you're using a digitizer, or a graphic tablet, and want to use
+	  it as a mouse then the mousedev driver needs to know the X window
+	  screen resolution you are using to correctly scale the data. If
+	  you're not using a digitizer, this value is ignored.
+
+config INPUT_JOYDEV
+	tristate "Joystick interface"
+	help
+	  Say Y here if you want your joystick or gamepad to be
+	  accessible as char device 13:0+ - /dev/input/jsX device.
+
+	  If unsure, say Y.
+
+	  More information is available: <file:Documentation/input/joydev/joystick.rst>
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called joydev.
+
+config INPUT_EVDEV
+	tristate "Event interface"
+	help
+	  Say Y here if you want your input device events be accessible
+	  under char device 13:64+ - /dev/input/eventX in a generic way.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called evdev.
+
+config INPUT_KUNIT_TEST
+	tristate "KUnit tests for Input" if !KUNIT_ALL_TESTS
+	depends on INPUT && KUNIT
+	default KUNIT_ALL_TESTS
+	help
+	  Say Y here if you want to build the KUnit tests for the input
+	  subsystem.
+
+	  If in doubt, say "N".
+
+config INPUT_APMPOWER
+	tristate "Input Power Event -> APM Bridge" if EXPERT
+	depends on INPUT && APM_EMULATION
+	help
+	  Say Y here if you want suspend key events to trigger a user
+	  requested suspend through APM. This is useful on embedded
+	  systems where such behaviour is desired without userspace
+	  interaction. If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called apm-power.
+
+comment "Input Device Drivers"
+
+source "drivers/input/keyboard/Kconfig"
+
+source "drivers/input/mouse/Kconfig"
+
+source "drivers/input/joystick/Kconfig"
+
+source "drivers/input/tablet/Kconfig"
+
+source "drivers/input/touchscreen/Kconfig"
+
+source "drivers/input/misc/Kconfig"
+
+source "drivers/input/rmi4/Kconfig"
+
+endif
+
+menu "Hardware I/O ports"
+
+source "drivers/input/serio/Kconfig"
+
+source "drivers/input/gameport/Kconfig"
+
+endmenu
+
+endmenu
+