openrisc: fix arbitrary kernel memory access via or1k_atomic syscallgrafted

sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.

    l.lwz   r29,0(r4)
    l.lwz   r27,0(r5)
    l.sw    0(r4),r27
    l.sw    0(r5),r29

The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.

A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.

This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.

Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.

[shorne@gmail.com: fix comment style]
Fixes: 9d02a4283e9c ("OpenRISC: Boot code")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>

1 files changed, 73 insertions, 0 deletions

diff --git a/include/sound/ak4531_codec.h b/include/sound/ak4531_codec.h
new file mode 100644
index 000000000..64402347d
--- /dev/null
+++ b/include/sound/ak4531_codec.h
@@ -0,0 +1,73 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#ifndef __SOUND_AK4531_CODEC_H
+#define __SOUND_AK4531_CODEC_H
+
+/*
+ *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
+ *  Universal interface for Audio Codec '97
+ *
+ *  For more details look to AC '97 component specification revision 2.1
+ *  by Intel Corporation (http://developer.intel.com).
+ */
+
+#include <sound/info.h>
+#include <sound/control.h>
+
+/*
+ *  ASAHI KASEI - AK4531 codec
+ *  - not really AC'97 codec, but it uses very similar interface as AC'97
+ */
+
+/*
+ *  AK4531 codec registers
+ */
+
+#define AK4531_LMASTER  0x00	/* master volume left */
+#define AK4531_RMASTER  0x01	/* master volume right */
+#define AK4531_LVOICE   0x02	/* channel volume left */
+#define AK4531_RVOICE   0x03	/* channel volume right */
+#define AK4531_LFM      0x04	/* FM volume left */
+#define AK4531_RFM      0x05	/* FM volume right */
+#define AK4531_LCD      0x06	/* CD volume left */
+#define AK4531_RCD      0x07	/* CD volume right */
+#define AK4531_LLINE    0x08	/* LINE volume left */
+#define AK4531_RLINE    0x09	/* LINE volume right */
+#define AK4531_LAUXA    0x0a	/* AUXA volume left */
+#define AK4531_RAUXA    0x0b	/* AUXA volume right */
+#define AK4531_MONO1    0x0c	/* MONO1 volume left */
+#define AK4531_MONO2    0x0d	/* MONO1 volume right */
+#define AK4531_MIC      0x0e	/* MIC volume */
+#define AK4531_MONO_OUT 0x0f	/* Mono-out volume */
+#define AK4531_OUT_SW1  0x10	/* Output mixer switch 1 */
+#define AK4531_OUT_SW2  0x11	/* Output mixer switch 2 */
+#define AK4531_LIN_SW1  0x12	/* Input left mixer switch 1 */
+#define AK4531_RIN_SW1  0x13	/* Input right mixer switch 1 */
+#define AK4531_LIN_SW2  0x14	/* Input left mixer switch 2 */
+#define AK4531_RIN_SW2  0x15	/* Input right mixer switch 2 */
+#define AK4531_RESET    0x16	/* Reset & power down */
+#define AK4531_CLOCK    0x17	/* Clock select */
+#define AK4531_AD_IN    0x18	/* AD input select */
+#define AK4531_MIC_GAIN 0x19	/* MIC amplified gain */
+
+struct snd_ak4531 {
+	void (*write) (struct snd_ak4531 *ak4531, unsigned short reg,
+		       unsigned short val);
+	void *private_data;
+	void (*private_free) (struct snd_ak4531 *ak4531);
+	/* --- */
+	unsigned char regs[0x20];
+	struct mutex reg_mutex;
+};
+
+int snd_ak4531_mixer(struct snd_card *card, struct snd_ak4531 *_ak4531,
+		     struct snd_ak4531 **rak4531);
+
+#ifdef CONFIG_PM
+void snd_ak4531_suspend(struct snd_ak4531 *ak4531);
+void snd_ak4531_resume(struct snd_ak4531 *ak4531);
+#else
+static inline void snd_ak4531_suspend(struct snd_ak4531 *ak4531) {}
+static inline void snd_ak4531_resume(struct snd_ak4531 *ak4531) {}
+#endif
+
+#endif /* __SOUND_AK4531_CODEC_H */