openrisc: fix arbitrary kernel memory access via or1k_atomic syscallgrafted

sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.

    l.lwz   r29,0(r4)
    l.lwz   r27,0(r5)
    l.sw    0(r4),r27
    l.sw    0(r5),r29

The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.

A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.

This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.

Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.

[shorne@gmail.com: fix comment style]
Fixes: 9d02a4283e9c ("OpenRISC: Boot code")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>

1 files changed, 67 insertions, 0 deletions

diff --git a/drivers/pinctrl/tegra/Kconfig b/drivers/pinctrl/tegra/Kconfig
new file mode 100644
index 000000000..39a93733e
--- /dev/null
+++ b/drivers/pinctrl/tegra/Kconfig
@@ -0,0 +1,67 @@
+# SPDX-License-Identifier: GPL-2.0-only
+config PINCTRL_TEGRA
+	bool "NVIDIA Tegra pin controllers common" if COMPILE_TEST && !ARCH_TEGRA
+	select PINMUX
+	select PINCONF
+
+config PINCTRL_TEGRA20
+	bool "NVIDIA Tegra20 pin controller" if COMPILE_TEST && !ARCH_TEGRA
+	select PINCTRL_TEGRA
+	depends on COMMON_CLK
+
+config PINCTRL_TEGRA30
+	bool "NVIDIA Tegra30 pin controller" if COMPILE_TEST && !ARCH_TEGRA
+	select PINCTRL_TEGRA
+
+config PINCTRL_TEGRA114
+	bool "NVIDIA Tegra114 pin controller" if COMPILE_TEST && !ARCH_TEGRA
+	select PINCTRL_TEGRA
+
+config PINCTRL_TEGRA124
+	bool "NVIDIA Tegra124 pin controller" if COMPILE_TEST && !ARCH_TEGRA
+	select PINCTRL_TEGRA
+
+config PINCTRL_TEGRA210
+	bool "NVIDIA Tegra210 pin controller" if COMPILE_TEST && !ARCH_TEGRA
+	select PINCTRL_TEGRA
+
+config PINCTRL_TEGRA186
+	bool "NVIDIA Tegra186 pin controller" if COMPILE_TEST && !ARCH_TEGRA
+	select PINCTRL_TEGRA
+
+config PINCTRL_TEGRA194
+	bool "NVIDIA Tegra194 pin controller" if COMPILE_TEST && !ARCH_TEGRA
+	select PINCTRL_TEGRA
+
+config PINCTRL_TEGRA234
+	bool "NVIDIA Tegra234 pin controller" if COMPILE_TEST && !ARCH_TEGRA
+	select PINCTRL_TEGRA
+
+config PINCTRL_TEGRA238
+	tristate "NVIDIA Tegra238 pinctrl driver"
+	depends on ARCH_TEGRA || COMPILE_TEST
+	default m if ARCH_TEGRA_238_SOC
+	select PINCTRL_TEGRA
+	help
+	  Say Y or M here to enable support for the pinctrl driver for
+	  NVIDIA Tegra238 SoC. This driver controls the pin multiplexing
+	  and configuration for the MAIN and AON pin controllers found
+	  on Tegra238.
+
+config PINCTRL_TEGRA264
+	tristate "NVIDIA Tegra264 pinctrl driver"
+	depends on ARCH_TEGRA || COMPILE_TEST
+	default m if ARCH_TEGRA_264_SOC
+	select PINCTRL_TEGRA
+	help
+	  Say Y or M here to enable support for the pinctrl driver for
+	  NVIDIA Tegra264 SoC. This driver controls the pin multiplexing
+	  and configuration for the MAIN, AON and UPHY pin controllers found
+	  on Tegra264.
+
+config PINCTRL_TEGRA_XUSB
+	bool "NVIDIA Tegra XUSB pin controller" if COMPILE_TEST && !ARCH_TEGRA
+	default y if ARCH_TEGRA
+	select GENERIC_PHY
+	select PINCONF
+	select PINMUX