From 78004e9a87f240df03e2f73120d291763c32e0a7 Mon Sep 17 00:00:00 2001 From: Ali Ahmet Memis Date: Fri, 21 Aug 2026 01:45:27 +0000 Subject: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries. A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly. This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context. Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT. [shorne@gmail.com: fix comment style] Fixes: 9d02a4283e9c ("OpenRISC: Boot code") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis Signed-off-by: Stafford Horne --- drivers/input/rmi4/Kconfig | 145 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 145 insertions(+) create mode 100644 drivers/input/rmi4/Kconfig (limited to 'drivers/input/rmi4/Kconfig') diff --git a/drivers/input/rmi4/Kconfig b/drivers/input/rmi4/Kconfig new file mode 100644 index 000000000..5db58fc9e --- /dev/null +++ b/drivers/input/rmi4/Kconfig @@ -0,0 +1,145 @@ +# SPDX-License-Identifier: GPL-2.0-only +# +# RMI4 configuration +# +config RMI4_CORE + tristate "Synaptics RMI4 bus support" + select IRQ_DOMAIN + help + Say Y here if you want to support the Synaptics RMI4 bus. This is + required for all RMI4 device support. + + If unsure, say Y. + +if RMI4_CORE + +config RMI4_I2C + tristate "RMI4 I2C Support" + depends on I2C + help + Say Y here if you want to support RMI4 devices connected to an I2C + bus. + + If unsure, say Y. + +config RMI4_SPI + tristate "RMI4 SPI Support" + depends on SPI + help + Say Y here if you want to support RMI4 devices connected to a SPI + bus. + + If unsure, say N. + +config RMI4_SMB + tristate "RMI4 SMB Support" + depends on I2C + help + Say Y here if you want to support RMI4 devices connected to an SMB + bus. + + If unsure, say N. + + To compile this driver as a module, choose M here: the module will be + called rmi_smbus. + +config RMI4_F03 + bool "RMI4 Function 03 (PS2 Guest)" + depends on RMI4_CORE + help + Say Y here if you want to add support for RMI4 function 03. + + Function 03 provides PS2 guest support for RMI4 devices. This + includes support for TrackPoints on TouchPads. + +config RMI4_F03_SERIO + tristate + depends on RMI4_CORE + depends on RMI4_F03 + default RMI4_CORE + select SERIO + +config RMI4_2D_SENSOR + bool + +config RMI4_F11 + bool "RMI4 Function 11 (2D pointing)" + select RMI4_2D_SENSOR + help + Say Y here if you want to add support for RMI4 function 11. + + Function 11 provides 2D multifinger pointing for touchscreens and + touchpads. For sensors that support relative pointing, F11 also + provides mouse input. + +config RMI4_F12 + bool "RMI4 Function 12 (2D pointing)" + select RMI4_2D_SENSOR + help + Say Y here if you want to add support for RMI4 function 12. + + Function 12 provides 2D multifinger pointing for touchscreens and + touchpads. For sensors that support relative pointing, F12 also + provides mouse input. + +config RMI4_F1A + bool "RMI4 Function 1A (0D pointing)" + help + Say Y here if you want to add support for RMI4 function 1A. + + Function 1A provides capacitive keys support for RMI4 devices. + +config RMI4_F21 + bool "RMI4 Function 21 (PRESSURE)" + help + Say Y here if you want to add support for RMI4 function 21. + + Function 21 provides buttons/pressure handling for RMI4 devices. + This includes support for buttons/pressure on PressurePad. + +config RMI4_F30 + bool "RMI4 Function 30 (GPIO LED)" + help + Say Y here if you want to add support for RMI4 function 30. + + Function 30 provides GPIO and LED support for RMI4 devices. This + includes support for buttons on TouchPads and ClickPads. + +config RMI4_F34 + bool "RMI4 Function 34 (Device reflash)" + select FW_LOADER + help + Say Y here if you want to add support for RMI4 function 34. + + Function 34 provides support for upgrading the firmware on the RMI4 + device via the firmware loader interface. This is triggered using a + sysfs attribute. + +config RMI4_F3A + bool "RMI4 Function 3A (GPIO)" + help + Say Y here if you want to add support for RMI4 function 3A. + + Function 3A provides GPIO support for RMI4 devices. This includes + support for buttons on TouchPads and ClickPads. + +config RMI4_F54 + bool "RMI4 Function 54 (Analog diagnostics)" + depends on VIDEO_DEV=y || (RMI4_CORE=m && VIDEO_DEV=m) + select VIDEOBUF2_VMALLOC + select RMI4_F55 + help + Say Y here if you want to add support for RMI4 function 54 + + Function 54 provides access to various diagnostic features in certain + RMI4 touch sensors. + +config RMI4_F55 + bool "RMI4 Function 55 (Sensor tuning)" + help + Say Y here if you want to add support for RMI4 function 55 + + Function 55 provides access to the RMI4 touch sensor tuning + mechanism. + +endif # RMI_CORE -- cgit v1.3.1