From 78004e9a87f240df03e2f73120d291763c32e0a7 Mon Sep 17 00:00:00 2001 From: Ali Ahmet Memis Date: Fri, 21 Aug 2026 01:45:27 +0000 Subject: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries. A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly. This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context. Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT. [shorne@gmail.com: fix comment style] Fixes: 9d02a4283e9c ("OpenRISC: Boot code") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis Signed-off-by: Stafford Horne --- arch/mips/cobalt/setup.c | 116 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 116 insertions(+) create mode 100644 arch/mips/cobalt/setup.c (limited to 'arch/mips/cobalt/setup.c') diff --git a/arch/mips/cobalt/setup.c b/arch/mips/cobalt/setup.c new file mode 100644 index 000000000..9a266bf78 --- /dev/null +++ b/arch/mips/cobalt/setup.c @@ -0,0 +1,116 @@ +/* + * Setup pointers to hardware dependent routines. + * + * This file is subject to the terms and conditions of the GNU General Public + * License. See the file "COPYING" in the main directory of this archive + * for more details. + * + * Copyright (C) 1996, 1997, 2004, 05 by Ralf Baechle (ralf@linux-mips.org) + * Copyright (C) 2001, 2002, 2003 by Liam Davies (ldavies@agile.tv) + * + */ +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include + +#include + +const char *get_system_type(void) +{ + switch (cobalt_board_id) { + case COBALT_BRD_ID_QUBE1: + return "Cobalt Qube"; + case COBALT_BRD_ID_RAQ1: + return "Cobalt RaQ"; + case COBALT_BRD_ID_QUBE2: + return "Cobalt Qube2"; + case COBALT_BRD_ID_RAQ2: + return "Cobalt RaQ2"; + } + return "MIPS Cobalt"; +} + +/* + * Cobalt doesn't have PS/2 keyboard/mouse interfaces, + * keyboard controller is never used. + * Also PCI-ISA bridge DMA controller is never used. + */ +static struct resource cobalt_reserved_resources[] = { + { /* dma1 */ + .start = 0x00, + .end = 0x1f, + .name = "reserved", + .flags = IORESOURCE_BUSY | IORESOURCE_IO, + }, + { /* keyboard */ + .start = 0x60, + .end = 0x6f, + .name = "reserved", + .flags = IORESOURCE_BUSY | IORESOURCE_IO, + }, + { /* dma page reg */ + .start = 0x80, + .end = 0x8f, + .name = "reserved", + .flags = IORESOURCE_BUSY | IORESOURCE_IO, + }, + { /* dma2 */ + .start = 0xc0, + .end = 0xdf, + .name = "reserved", + .flags = IORESOURCE_BUSY | IORESOURCE_IO, + }, +}; + +void __init plat_mem_setup(void) +{ + int i; + + _machine_restart = cobalt_machine_restart; + _machine_halt = cobalt_machine_halt; + pm_power_off = cobalt_machine_halt; + + set_io_port_base(CKSEG1ADDR(GT_DEF_PCI0_IO_BASE)); + + /* I/O port resource */ + ioport_resource.end = 0x01ffffff; + + /* These resources have been reserved by VIA SuperI/O chip. */ + for (i = 0; i < ARRAY_SIZE(cobalt_reserved_resources); i++) + request_resource(&ioport_resource, cobalt_reserved_resources + i); +} + +/* + * Prom init. We read our one and only communication with the firmware. + * Grab the amount of installed memory. + * Better boot loaders (CoLo) pass a command line too :-) + */ + +void __init prom_init(void) +{ + unsigned long memsz; + int argc, i; + char **argv; + + memsz = fw_arg0 & 0x7fff0000; + argc = fw_arg0 & 0x0000ffff; + argv = (char **)fw_arg1; + + for (i = 1; i < argc; i++) { + strlcat(arcs_cmdline, argv[i], COMMAND_LINE_SIZE); + if (i < (argc - 1)) + strlcat(arcs_cmdline, " ", COMMAND_LINE_SIZE); + } + + memblock_add(0, memsz); + + setup_8250_early_printk_port(CKSEG1ADDR(0x1c800000), 0, 0); +} -- cgit v1.3.1