From 78004e9a87f240df03e2f73120d291763c32e0a7 Mon Sep 17 00:00:00 2001 From: Ali Ahmet Memis Date: Fri, 21 Aug 2026 01:45:27 +0000 Subject: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries. A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly. This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context. Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT. [shorne@gmail.com: fix comment style] Fixes: 9d02a4283e9c ("OpenRISC: Boot code") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis Signed-off-by: Stafford Horne --- drivers/mfd/rt4831.c | 119 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 119 insertions(+) create mode 100644 drivers/mfd/rt4831.c (limited to 'drivers/mfd/rt4831.c') diff --git a/drivers/mfd/rt4831.c b/drivers/mfd/rt4831.c new file mode 100644 index 000000000..1ab8870e4 --- /dev/null +++ b/drivers/mfd/rt4831.c @@ -0,0 +1,119 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (c) 2021 Richtek Technology Corp. + * + * Author: ChiYuan Huang + */ + +#include +#include +#include +#include +#include +#include + +#define RT4831_REG_REVISION 0x01 +#define RT4831_REG_ENABLE 0x08 +#define RT4831_REG_I2CPROT 0x15 + +#define RICHTEK_VENDOR_ID 0x03 +#define RT4831_VID_MASK GENMASK(1, 0) +#define RT4831_RESET_MASK BIT(7) +#define RT4831_I2CSAFETMR_MASK BIT(0) + +static const struct mfd_cell rt4831_subdevs[] = { + MFD_CELL_OF("rt4831-backlight", NULL, NULL, 0, 0, "richtek,rt4831-backlight"), + MFD_CELL_NAME("rt4831-regulator") +}; + +static bool rt4831_is_accessible_reg(struct device *dev, unsigned int reg) +{ + if (reg >= RT4831_REG_REVISION && reg <= RT4831_REG_I2CPROT) + return true; + return false; +} + +static const struct regmap_config rt4831_regmap_config = { + .reg_bits = 8, + .val_bits = 8, + .max_register = RT4831_REG_I2CPROT, + + .readable_reg = rt4831_is_accessible_reg, + .writeable_reg = rt4831_is_accessible_reg, +}; + +static int rt4831_probe(struct i2c_client *client) +{ + struct gpio_desc *enable_gpio; + struct regmap *regmap; + unsigned int chip_id; + int ret; + + enable_gpio = devm_gpiod_get_optional(&client->dev, "enable", GPIOD_OUT_HIGH); + if (IS_ERR(enable_gpio)) { + dev_err(&client->dev, "Failed to get 'enable' GPIO\n"); + return PTR_ERR(enable_gpio); + } + + regmap = devm_regmap_init_i2c(client, &rt4831_regmap_config); + if (IS_ERR(regmap)) { + dev_err(&client->dev, "Failed to initialize regmap\n"); + return PTR_ERR(regmap); + } + + ret = regmap_read(regmap, RT4831_REG_REVISION, &chip_id); + if (ret) { + dev_err(&client->dev, "Failed to get H/W revision\n"); + return ret; + } + + if ((chip_id & RT4831_VID_MASK) != RICHTEK_VENDOR_ID) { + dev_err(&client->dev, "Chip vendor ID 0x%02x not matched\n", chip_id); + return -ENODEV; + } + + /* + * Used to prevent the abnormal shutdown. + * If SCL/SDA both keep low for one second to reset HW. + */ + ret = regmap_update_bits(regmap, RT4831_REG_I2CPROT, RT4831_I2CSAFETMR_MASK, + RT4831_I2CSAFETMR_MASK); + if (ret) { + dev_err(&client->dev, "Failed to enable I2C safety timer\n"); + return ret; + } + + return devm_mfd_add_devices(&client->dev, PLATFORM_DEVID_AUTO, rt4831_subdevs, + ARRAY_SIZE(rt4831_subdevs), NULL, 0, NULL); +} + +static void rt4831_remove(struct i2c_client *client) +{ + struct regmap *regmap = dev_get_regmap(&client->dev, NULL); + int ret; + + /* Disable WLED and DSV outputs */ + ret = regmap_update_bits(regmap, RT4831_REG_ENABLE, RT4831_RESET_MASK, RT4831_RESET_MASK); + if (ret) + dev_warn(&client->dev, "Failed to disable outputs (%pe)\n", ERR_PTR(ret)); +} + +static const struct of_device_id __maybe_unused rt4831_of_match[] = { + { .compatible = "richtek,rt4831", }, + {} +}; +MODULE_DEVICE_TABLE(of, rt4831_of_match); + +static struct i2c_driver rt4831_driver = { + .driver = { + .name = "rt4831", + .of_match_table = rt4831_of_match, + }, + .probe = rt4831_probe, + .remove = rt4831_remove, +}; +module_i2c_driver(rt4831_driver); + +MODULE_AUTHOR("ChiYuan Huang "); +MODULE_DESCRIPTION("Richtek RT4831 core driver"); +MODULE_LICENSE("GPL v2"); -- cgit v1.3.1