From 78004e9a87f240df03e2f73120d291763c32e0a7 Mon Sep 17 00:00:00 2001 From: Ali Ahmet Memis Date: Fri, 21 Aug 2026 01:45:27 +0000 Subject: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries. A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly. This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context. Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT. [shorne@gmail.com: fix comment style] Fixes: 9d02a4283e9c ("OpenRISC: Boot code") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis Signed-off-by: Stafford Horne --- include/sound/ak4531_codec.h | 73 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 include/sound/ak4531_codec.h (limited to 'include/sound/ak4531_codec.h') diff --git a/include/sound/ak4531_codec.h b/include/sound/ak4531_codec.h new file mode 100644 index 000000000..64402347d --- /dev/null +++ b/include/sound/ak4531_codec.h @@ -0,0 +1,73 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +#ifndef __SOUND_AK4531_CODEC_H +#define __SOUND_AK4531_CODEC_H + +/* + * Copyright (c) by Jaroslav Kysela + * Universal interface for Audio Codec '97 + * + * For more details look to AC '97 component specification revision 2.1 + * by Intel Corporation (http://developer.intel.com). + */ + +#include +#include + +/* + * ASAHI KASEI - AK4531 codec + * - not really AC'97 codec, but it uses very similar interface as AC'97 + */ + +/* + * AK4531 codec registers + */ + +#define AK4531_LMASTER 0x00 /* master volume left */ +#define AK4531_RMASTER 0x01 /* master volume right */ +#define AK4531_LVOICE 0x02 /* channel volume left */ +#define AK4531_RVOICE 0x03 /* channel volume right */ +#define AK4531_LFM 0x04 /* FM volume left */ +#define AK4531_RFM 0x05 /* FM volume right */ +#define AK4531_LCD 0x06 /* CD volume left */ +#define AK4531_RCD 0x07 /* CD volume right */ +#define AK4531_LLINE 0x08 /* LINE volume left */ +#define AK4531_RLINE 0x09 /* LINE volume right */ +#define AK4531_LAUXA 0x0a /* AUXA volume left */ +#define AK4531_RAUXA 0x0b /* AUXA volume right */ +#define AK4531_MONO1 0x0c /* MONO1 volume left */ +#define AK4531_MONO2 0x0d /* MONO1 volume right */ +#define AK4531_MIC 0x0e /* MIC volume */ +#define AK4531_MONO_OUT 0x0f /* Mono-out volume */ +#define AK4531_OUT_SW1 0x10 /* Output mixer switch 1 */ +#define AK4531_OUT_SW2 0x11 /* Output mixer switch 2 */ +#define AK4531_LIN_SW1 0x12 /* Input left mixer switch 1 */ +#define AK4531_RIN_SW1 0x13 /* Input right mixer switch 1 */ +#define AK4531_LIN_SW2 0x14 /* Input left mixer switch 2 */ +#define AK4531_RIN_SW2 0x15 /* Input right mixer switch 2 */ +#define AK4531_RESET 0x16 /* Reset & power down */ +#define AK4531_CLOCK 0x17 /* Clock select */ +#define AK4531_AD_IN 0x18 /* AD input select */ +#define AK4531_MIC_GAIN 0x19 /* MIC amplified gain */ + +struct snd_ak4531 { + void (*write) (struct snd_ak4531 *ak4531, unsigned short reg, + unsigned short val); + void *private_data; + void (*private_free) (struct snd_ak4531 *ak4531); + /* --- */ + unsigned char regs[0x20]; + struct mutex reg_mutex; +}; + +int snd_ak4531_mixer(struct snd_card *card, struct snd_ak4531 *_ak4531, + struct snd_ak4531 **rak4531); + +#ifdef CONFIG_PM +void snd_ak4531_suspend(struct snd_ak4531 *ak4531); +void snd_ak4531_resume(struct snd_ak4531 *ak4531); +#else +static inline void snd_ak4531_suspend(struct snd_ak4531 *ak4531) {} +static inline void snd_ak4531_resume(struct snd_ak4531 *ak4531) {} +#endif + +#endif /* __SOUND_AK4531_CODEC_H */ -- cgit v1.3.1