openrisc: fix arbitrary kernel memory access via or1k_atomic syscallgrafted

sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.

    l.lwz   r29,0(r4)
    l.lwz   r27,0(r5)
    l.sw    0(r4),r27
    l.sw    0(r5),r29

The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.

A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.

This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.

Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.

[shorne@gmail.com: fix comment style]
Fixes: 9d02a4283e9c ("OpenRISC: Boot code")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>

1 files changed, 81 insertions, 0 deletions

diff --git a/drivers/net/slip/Kconfig b/drivers/net/slip/Kconfig
new file mode 100644
index 000000000..ea68fc15c
--- /dev/null
+++ b/drivers/net/slip/Kconfig
@@ -0,0 +1,81 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# SLIP network device configuration
+#
+
+config SLIP
+	tristate "SLIP (serial line) support"
+	depends on TTY
+	help
+	  Say Y if you intend to use SLIP or CSLIP (compressed SLIP) to
+	  connect to your Internet service provider or to connect to some
+	  other local Unix box or if you want to configure your Linux box as a
+	  Slip/CSlip server for other people to dial in. SLIP (Serial Line
+	  Internet Protocol) is a protocol used to send Internet traffic over
+	  serial connections such as telephone lines or null modem cables;
+	  nowadays, the protocol PPP is more commonly used for this same
+	  purpose.
+
+	  Normally, your access provider has to support SLIP in order for you
+	  to be able to use it, but there is now a SLIP emulator called SLiRP
+	  around (available from
+	  <ftp://ibiblio.org/pub/Linux/system/network/serial/>) which
+	  allows you to use SLIP over a regular dial up shell connection. If
+	  you plan to use SLiRP, make sure to say Y to CSLIP, below. The
+	  NET-3-HOWTO, available from
+	  <http://www.tldp.org/docs.html#howto>, explains how to
+	  configure SLIP. Note that you don't need this option if you just
+	  want to run term (term is a program which gives you almost full
+	  Internet connectivity if you have a regular dial up shell account on
+	  some Internet connected Unix computer. Read
+	  <http://www.bart.nl/~patrickr/term-howto/Term-HOWTO.html>). SLIP
+	  support will enlarge your kernel by about 4 KB. If unsure, say N.
+
+	  To compile this driver as a module, choose M here. The module
+	  will be called slip.
+
+config SLHC
+	tristate
+	help
+	  This option enables Van Jacobsen serial line header compression
+	  routines.
+
+if SLIP
+
+config SLIP_COMPRESSED
+	bool "CSLIP compressed headers"
+	depends on SLIP
+	select SLHC
+	help
+	  This protocol is faster than SLIP because it uses compression on the
+	  TCP/IP headers (not on the data itself), but it has to be supported
+	  on both ends. Ask your access provider if you are not sure and
+	  answer Y, just in case. You will still be able to use plain SLIP. If
+	  you plan to use SLiRP, the SLIP emulator (available from
+	  <ftp://ibiblio.org/pub/Linux/system/network/serial/>) which
+	  allows you to use SLIP over a regular dial up shell connection, you
+	  definitely want to say Y here. The NET-3-HOWTO, available from
+	  <http://www.tldp.org/docs.html#howto>, explains how to configure
+	  CSLIP. This won't enlarge your kernel.
+
+config SLIP_SMART
+	bool "Keepalive and linefill"
+	depends on SLIP
+	help
+	  Adds additional capabilities to the SLIP driver to support the
+	  RELCOM line fill and keepalive monitoring. Ideal on poor quality
+	  analogue lines.
+
+config SLIP_MODE_SLIP6
+	bool "Six bit SLIP encapsulation"
+	depends on SLIP
+	help
+	  Just occasionally you may need to run IP over hostile serial
+	  networks that don't pass all control characters or are only seven
+	  bit. Saying Y here adds an extra mode you can use with SLIP:
+	  "slip6". In this mode, SLIP will only send normal ASCII symbols over
+	  the serial device. Naturally, this has to be supported at the other
+	  end of the link as well. It's good enough, for example, to run IP
+	  over the async ports of a Camtec JNT Pad. If unsure, say N.
+
+endif # SLIP