From 78004e9a87f240df03e2f73120d291763c32e0a7 Mon Sep 17 00:00:00 2001 From: Ali Ahmet Memis Date: Fri, 21 Aug 2026 01:45:27 +0000 Subject: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries. A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly. This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context. Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT. [shorne@gmail.com: fix comment style] Fixes: 9d02a4283e9c ("OpenRISC: Boot code") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis Signed-off-by: Stafford Horne --- drivers/soc/gemini/Makefile | 2 ++ drivers/soc/gemini/soc-gemini.c | 71 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 73 insertions(+) create mode 100644 drivers/soc/gemini/Makefile create mode 100644 drivers/soc/gemini/soc-gemini.c (limited to 'drivers/soc/gemini') diff --git a/drivers/soc/gemini/Makefile b/drivers/soc/gemini/Makefile new file mode 100644 index 000000000..8cbd1e45d --- /dev/null +++ b/drivers/soc/gemini/Makefile @@ -0,0 +1,2 @@ +# SPDX-License-Identifier: GPL-2.0 +obj-y += soc-gemini.o diff --git a/drivers/soc/gemini/soc-gemini.c b/drivers/soc/gemini/soc-gemini.c new file mode 100644 index 000000000..642b96c91 --- /dev/null +++ b/drivers/soc/gemini/soc-gemini.c @@ -0,0 +1,71 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2017 Linaro Ltd. + * + * Author: Linus Walleij + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2, as + * published by the Free Software Foundation. + * + */ +#include +#include +#include +#include +#include + +#define GLOBAL_WORD_ID 0x00 +#define GEMINI_GLOBAL_ARB1_CTRL 0x2c +#define GEMINI_ARB1_BURST_MASK GENMASK(21, 16) +#define GEMINI_ARB1_BURST_SHIFT 16 +/* These all define the priority on the BUS2 backplane */ +#define GEMINI_ARB1_PRIO_MASK GENMASK(9, 0) +#define GEMINI_ARB1_DMAC_HIGH_PRIO BIT(0) +#define GEMINI_ARB1_IDE_HIGH_PRIO BIT(1) +#define GEMINI_ARB1_RAID_HIGH_PRIO BIT(2) +#define GEMINI_ARB1_SECURITY_HIGH_PRIO BIT(3) +#define GEMINI_ARB1_GMAC0_HIGH_PRIO BIT(4) +#define GEMINI_ARB1_GMAC1_HIGH_PRIO BIT(5) +#define GEMINI_ARB1_USB0_HIGH_PRIO BIT(6) +#define GEMINI_ARB1_USB1_HIGH_PRIO BIT(7) +#define GEMINI_ARB1_PCI_HIGH_PRIO BIT(8) +#define GEMINI_ARB1_TVE_HIGH_PRIO BIT(9) + +#define GEMINI_DEFAULT_BURST_SIZE 0x20 +#define GEMINI_DEFAULT_PRIO (GEMINI_ARB1_GMAC0_HIGH_PRIO | \ + GEMINI_ARB1_GMAC1_HIGH_PRIO) + +static int __init gemini_soc_init(void) +{ + struct regmap *map; + u32 rev; + u32 val; + int ret; + + /* Multiplatform guard, only proceed on Gemini */ + if (!of_machine_is_compatible("cortina,gemini")) + return 0; + + map = syscon_regmap_lookup_by_compatible("cortina,gemini-syscon"); + if (IS_ERR(map)) + return PTR_ERR(map); + ret = regmap_read(map, GLOBAL_WORD_ID, &rev); + if (ret) + return ret; + + val = (GEMINI_DEFAULT_BURST_SIZE << GEMINI_ARB1_BURST_SHIFT) | + GEMINI_DEFAULT_PRIO; + + /* Set up system arbitration */ + regmap_update_bits(map, + GEMINI_GLOBAL_ARB1_CTRL, + GEMINI_ARB1_BURST_MASK | GEMINI_ARB1_PRIO_MASK, + val); + + pr_info("Gemini SoC %04x revision %02x, set arbitration %08x\n", + rev >> 8, rev & 0xff, val); + + return 0; +} +subsys_initcall(gemini_soc_init); -- cgit v1.3.1