From 78004e9a87f240df03e2f73120d291763c32e0a7 Mon Sep 17 00:00:00 2001 From: Ali Ahmet Memis Date: Fri, 21 Aug 2026 01:45:27 +0000 Subject: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries. A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly. This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context. Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT. [shorne@gmail.com: fix comment style] Fixes: 9d02a4283e9c ("OpenRISC: Boot code") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis Signed-off-by: Stafford Horne --- fs/squashfs/file_direct.c | 124 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 124 insertions(+) create mode 100644 fs/squashfs/file_direct.c (limited to 'fs/squashfs/file_direct.c') diff --git a/fs/squashfs/file_direct.c b/fs/squashfs/file_direct.c new file mode 100644 index 000000000..2c3e809d6 --- /dev/null +++ b/fs/squashfs/file_direct.c @@ -0,0 +1,124 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copyright (c) 2013 + * Phillip Lougher + */ + +#include +#include +#include +#include +#include +#include +#include + +#include "squashfs_fs.h" +#include "squashfs_fs_sb.h" +#include "squashfs_fs_i.h" +#include "squashfs.h" +#include "page_actor.h" + +/* Read separately compressed datablock directly into page cache */ +int squashfs_readpage_block(struct folio *folio, u64 block, int bsize, + int expected) +{ + struct page *target_page = &folio->page; + struct inode *inode = folio->mapping->host; + struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info; + loff_t file_end = (i_size_read(inode) - 1) >> PAGE_SHIFT; + int mask = (1 << (msblk->block_log - PAGE_SHIFT)) - 1; + loff_t start_index = folio->index & ~mask; + loff_t end_index = start_index | mask; + loff_t index; + int i, pages, bytes, res = -ENOMEM; + struct page **page, *last_page; + struct squashfs_page_actor *actor; + void *pageaddr; + + if (end_index > file_end) + end_index = file_end; + + pages = end_index - start_index + 1; + + page = kmalloc_array(pages, sizeof(void *), GFP_KERNEL); + if (page == NULL) + return res; + + /* Try to grab all the pages covered by the Squashfs block */ + for (i = 0, index = start_index; index <= end_index; index++) { + page[i] = (index == folio->index) ? target_page : + grab_cache_page_nowait(folio->mapping, index); + + if (page[i] == NULL) + continue; + + if (PageUptodate(page[i])) { + unlock_page(page[i]); + put_page(page[i]); + continue; + } + + i++; + } + + pages = i; + + /* + * Create a "page actor" which will kmap and kunmap the + * page cache pages appropriately within the decompressor + */ + actor = squashfs_page_actor_init_special(msblk, page, pages, expected, + start_index << PAGE_SHIFT); + if (actor == NULL) + goto out; + + /* Decompress directly into the page cache buffers */ + res = squashfs_read_data(inode->i_sb, block, bsize, NULL, actor); + + last_page = squashfs_page_actor_free(actor); + + if (res < 0) + goto mark_errored; + + if (res != expected || IS_ERR(last_page)) { + res = -EIO; + goto mark_errored; + } + + /* Last page (if present) may have trailing bytes not filled */ + bytes = res % PAGE_SIZE; + if (end_index == file_end && last_page && bytes) { + pageaddr = kmap_local_page(last_page); + memset(pageaddr + bytes, 0, PAGE_SIZE - bytes); + kunmap_local(pageaddr); + } + + /* Mark pages as uptodate, unlock and release */ + for (i = 0; i < pages; i++) { + flush_dcache_page(page[i]); + SetPageUptodate(page[i]); + unlock_page(page[i]); + if (page[i] != target_page) + put_page(page[i]); + } + + kfree(page); + + return 0; + +mark_errored: + /* Decompression failed. Target_page is + * dealt with by the caller + */ + for (i = 0; i < pages; i++) { + if (page[i] == NULL || page[i] == target_page) + continue; + flush_dcache_page(page[i]); + unlock_page(page[i]); + put_page(page[i]); + } + +out: + kfree(page); + return res; +} -- cgit v1.3.1