From 78004e9a87f240df03e2f73120d291763c32e0a7 Mon Sep 17 00:00:00 2001 From: Ali Ahmet Memis Date: Fri, 21 Aug 2026 01:45:27 +0000 Subject: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries. A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly. This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context. Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT. [shorne@gmail.com: fix comment style] Fixes: 9d02a4283e9c ("OpenRISC: Boot code") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis Signed-off-by: Stafford Horne --- drivers/bcma/Kconfig | 118 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 118 insertions(+) create mode 100644 drivers/bcma/Kconfig (limited to 'drivers/bcma/Kconfig') diff --git a/drivers/bcma/Kconfig b/drivers/bcma/Kconfig new file mode 100644 index 000000000..b9558ff20 --- /dev/null +++ b/drivers/bcma/Kconfig @@ -0,0 +1,118 @@ +# SPDX-License-Identifier: GPL-2.0 +config BCMA_POSSIBLE + bool + depends on HAS_IOMEM && HAS_DMA + default y + +menuconfig BCMA + tristate "Broadcom specific AMBA" + depends on BCMA_POSSIBLE + help + Bus driver for Broadcom specific Advanced Microcontroller Bus + Architecture. + +if BCMA + +# Support for Block-I/O. SELECT this from the driver that needs it. +config BCMA_BLOCKIO + bool + +config BCMA_HOST_PCI_POSSIBLE + bool + depends on PCI = y + default y + +config BCMA_HOST_PCI + bool "Support for BCMA on PCI-host bus" + depends on BCMA_HOST_PCI_POSSIBLE + select BCMA_DRIVER_PCI + default y + +config BCMA_HOST_SOC + bool "Support for BCMA in a SoC" + depends on HAS_IOMEM + help + Host interface for a Broadcom AIX bus directly mapped into + the memory. This only works with the Broadcom SoCs from the + BCM47XX line. + + If unsure, say N + +config BCMA_DRIVER_PCI + bool "BCMA Broadcom PCI core driver" + depends on PCI + default y + help + BCMA bus may have many versions of PCIe core. This driver + supports: + 1) PCIe core working in clientmode + 2) PCIe Gen 2 clientmode core + + In general PCIe (Gen 2) clientmode core is required on PCIe + hosted buses. It's responsible for initialization and basic + hardware management. + This driver is also prerequisite for a hostmode PCIe core + support. + +config BCMA_DRIVER_PCI_HOSTMODE + bool "Driver for PCI core working in hostmode" + depends on MIPS && BCMA_DRIVER_PCI && PCI_DRIVERS_LEGACY && BCMA = y + help + PCI core hostmode operation (external PCI bus). + +config BCMA_DRIVER_MIPS + bool "BCMA Broadcom MIPS core driver" + depends on MIPS || COMPILE_TEST + help + Driver for the Broadcom MIPS core attached to Broadcom specific + Advanced Microcontroller Bus. + + If unsure, say N + +config BCMA_PFLASH + bool + depends on BCMA_DRIVER_MIPS + default y + +config BCMA_SFLASH + bool "ChipCommon-attached serial flash support" + depends on BCMA_HOST_SOC + default y + help + Some cheap devices have serial flash connected to the ChipCommon + instead of independent SPI controller. It requires using a separated + driver that implements ChipCommon specific interface communication. + + Enabling this symbol will let bcma recognize serial flash and register + it as platform device. + +config BCMA_NFLASH + bool + depends on BCMA_DRIVER_MIPS + default y + +config BCMA_DRIVER_GMAC_CMN + bool "BCMA Broadcom GBIT MAC COMMON core driver" + help + Driver for the Broadcom GBIT MAC COMMON core attached to Broadcom + specific Advanced Microcontroller Bus. + + If unsure, say N + +config BCMA_DRIVER_GPIO + bool "BCMA GPIO driver" + depends on GPIOLIB + select GPIOLIB_IRQCHIP if BCMA_HOST_SOC + help + Driver to provide access to the GPIO pins of the bcma bus. + + If unsure, say N + +config BCMA_DEBUG + bool "BCMA debugging" + help + This turns on additional debugging messages. + + If unsure, say N + +endif # BCMA -- cgit v1.3.1