From 78004e9a87f240df03e2f73120d291763c32e0a7 Mon Sep 17 00:00:00 2001 From: Ali Ahmet Memis Date: Fri, 21 Aug 2026 01:45:27 +0000 Subject: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries. A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly. This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context. Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT. [shorne@gmail.com: fix comment style] Fixes: 9d02a4283e9c ("OpenRISC: Boot code") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis Signed-off-by: Stafford Horne --- Documentation/ABI/testing/sysfs-class-rapidio | 59 +++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 Documentation/ABI/testing/sysfs-class-rapidio (limited to 'Documentation/ABI/testing/sysfs-class-rapidio') diff --git a/Documentation/ABI/testing/sysfs-class-rapidio b/Documentation/ABI/testing/sysfs-class-rapidio new file mode 100644 index 000000000..81e091455 --- /dev/null +++ b/Documentation/ABI/testing/sysfs-class-rapidio @@ -0,0 +1,59 @@ +What: /sys/class/rapidio_port +Description: + On-chip RapidIO controllers and PCIe-to-RapidIO bridges + (referenced as "Master Port" or "mport") are presented in sysfs + as the special class of devices: "rapidio_port". + The /sys/class/rapidio_port subdirectory contains individual + subdirectories named as "rapidioN" where N = mport ID registered + with RapidIO subsystem. + + NOTE: An mport ID is not a RapidIO destination ID assigned to a + given local mport device. + +What: /sys/class/rapidio_port/rapidio/sys_size +Date: Apr, 2014 +KernelVersion: v3.15 +Contact: Matt Porter , + Alexandre Bounine +Description: + (RO) reports RapidIO common transport system size: + + 0 = small (8-bit destination ID, max. 256 devices), + + 1 = large (16-bit destination ID, max. 65536 devices). + +What: /sys/class/rapidio_port/rapidio/port_destid +Date: Apr, 2014 +KernelVersion: v3.15 +Contact: Matt Porter , + Alexandre Bounine +Description: + +(RO) reports RapidIO destination ID assigned to the given +RapidIO mport device. If value 0xFFFFFFFF is returned this means +that no valid destination ID have been assigned to the mport +(yet). Normally, before enumeration/discovery have been executed +only fabric enumerating mports have a valid destination ID +assigned to them using "hdid=..." rapidio module parameter. + +After enumeration or discovery was performed for a given mport device, +the corresponding subdirectory will also contain subdirectories for each +child RapidIO device connected to the mport. + +The example below shows mport device subdirectory with several child RapidIO +devices attached to it:: + + [rio@rapidio ~]$ ls /sys/class/rapidio_port/rapidio0/ -l + total 0 + drwxr-xr-x 3 root root 0 Feb 11 15:10 00:e:0001 + drwxr-xr-x 3 root root 0 Feb 11 15:10 00:e:0004 + drwxr-xr-x 3 root root 0 Feb 11 15:10 00:e:0007 + drwxr-xr-x 3 root root 0 Feb 11 15:10 00:s:0002 + drwxr-xr-x 3 root root 0 Feb 11 15:10 00:s:0003 + drwxr-xr-x 3 root root 0 Feb 11 15:10 00:s:0005 + lrwxrwxrwx 1 root root 0 Feb 11 15:11 device -> ../../../0000:01:00.0 + -r--r--r-- 1 root root 4096 Feb 11 15:11 port_destid + drwxr-xr-x 2 root root 0 Feb 11 15:11 power + lrwxrwxrwx 1 root root 0 Feb 11 15:04 subsystem -> ../../../../../../class/rapidio_port + -r--r--r-- 1 root root 4096 Feb 11 15:11 sys_size + -rw-r--r-- 1 root root 4096 Feb 11 15:04 uevent -- cgit v1.3.1