openrisc: fix arbitrary kernel memory access via or1k_atomic syscallgrafted

sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.

    l.lwz   r29,0(r4)
    l.lwz   r27,0(r5)
    l.sw    0(r4),r27
    l.sw    0(r5),r29

The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.

A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.

This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.

Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.

[shorne@gmail.com: fix comment style]
Fixes: 9d02a4283e9c ("OpenRISC: Boot code")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>

1 files changed, 86 insertions, 0 deletions

diff --git a/drivers/net/arcnet/Kconfig b/drivers/net/arcnet/Kconfig
new file mode 100644
index 000000000..4611a3716
--- /dev/null
+++ b/drivers/net/arcnet/Kconfig
@@ -0,0 +1,86 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Arcnet configuration
+#
+
+menuconfig ARCNET
+	depends on NETDEVICES && PCI && HAS_IOPORT
+	tristate "ARCnet support"
+	help
+	  If you have a network card of this type, say Y and check out the
+	  (arguably) beautiful poetry in
+	  <file:Documentation/networking/arcnet.rst>.
+
+	  You need both this driver, and the driver for the particular ARCnet
+	  chipset of your card.
+
+	  To compile this driver as a module, choose M here. The module will
+	  be called arcnet.
+
+if ARCNET
+
+config ARCNET_1201
+	tristate "Enable standard ARCNet packet format (RFC 1201)"
+	help
+	  This allows you to use RFC1201 with your ARCnet card via the virtual
+	  arc0 device.  You need to say Y here to communicate with
+	  industry-standard RFC1201 implementations, like the arcether.com
+	  packet driver or most DOS/Windows ODI drivers.  Please read the
+	  ARCnet documentation in <file:Documentation/networking/arcnet.rst>
+	  for more information about using arc0.
+
+config ARCNET_1051
+	tristate "Enable old ARCNet packet format (RFC 1051)"
+	help
+	  This allows you to use RFC1051 with your ARCnet card via the virtual
+	  arc0s device. You only need arc0s if you want to talk to ARCnet
+	  software complying with the "old" standard, specifically, the DOS
+	  arcnet.com packet driver, Amigas running AmiTCP, and some variants
+	  of NetBSD. You do not need to say Y here to communicate with
+	  industry-standard RFC1201 implementations, like the arcether.com
+	  packet driver or most DOS/Windows ODI drivers. RFC1201 is included
+	  automatically as the arc0 device. Please read the ARCnet
+	  documentation in <file:Documentation/networking/arcnet.rst> for more
+	  information about using arc0e and arc0s.
+
+config ARCNET_RAW
+	tristate "Enable raw mode packet interface"
+	help
+	  ARCnet "raw mode" packet encapsulation, no soft headers.  Unlikely
+	  to work unless talking to a copy of the same Linux arcnet driver,
+	  but perhaps marginally faster in that case.
+
+config ARCNET_CAP
+	tristate "Enable CAP mode packet interface"
+	help
+	  ARCnet "cap mode" packet encapsulation. Used to get the hardware
+	  acknowledge back to userspace. After the initial protocol byte every
+	  packet is stuffed with an extra 4 byte "cookie" which doesn't
+	  actually appear on the network. After transmit the driver will send
+	  back a packet with protocol byte 0 containing the status of the
+	  transmission:
+	     0=no hardware acknowledge
+	     1=excessive nak
+	     2=transmission accepted by the receiver hardware
+
+	  Received packets are also stuffed with the extra 4 bytes but it will
+	  be random data.
+
+	  Cap only listens to protocol 1-8.
+
+config ARCNET_COM20020
+	tristate "ARCnet COM20020 chipset driver"
+	depends on LEDS_CLASS
+	help
+	  This is the driver for the new COM20020 chipset. It supports such
+	  things as promiscuous mode, so packet sniffing is possible, and
+	  extra diagnostic information.
+
+	  To compile this driver as a module, choose M here. The module will
+	  be called com20020.
+
+config ARCNET_COM20020_PCI
+	tristate "Support for COM20020 on PCI"
+	depends on ARCNET_COM20020 && PCI
+
+endif # ARCNET