From 78004e9a87f240df03e2f73120d291763c32e0a7 Mon Sep 17 00:00:00 2001 From: Ali Ahmet Memis Date: Fri, 21 Aug 2026 01:45:27 +0000 Subject: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries. A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly. This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context. Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT. [shorne@gmail.com: fix comment style] Fixes: 9d02a4283e9c ("OpenRISC: Boot code") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis Signed-off-by: Stafford Horne --- tools/perf/util/maps.h | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) create mode 100644 tools/perf/util/maps.h (limited to 'tools/perf/util/maps.h') diff --git a/tools/perf/util/maps.h b/tools/perf/util/maps.h new file mode 100644 index 000000000..4ec9b7453 --- /dev/null +++ b/tools/perf/util/maps.h @@ -0,0 +1,88 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __PERF_MAPS_H +#define __PERF_MAPS_H + +#include +#include +#include +#include + +struct ref_reloc_sym; +struct machine; +struct map; +struct maps; + +#define KMAP_NAME_LEN 256 + +struct kmap { + struct ref_reloc_sym *ref_reloc_sym; + struct maps *kmaps; + char name[KMAP_NAME_LEN]; +}; + +struct maps *maps__new(struct machine *machine); +bool maps__empty(struct maps *maps); +int maps__copy_from(struct maps *maps, struct maps *parent); + +struct maps *maps__get(struct maps *maps); +void maps__put(struct maps *maps); + +static inline void __maps__zput(struct maps **map) +{ + maps__put(*map); + *map = NULL; +} + +#define maps__zput(map) __maps__zput(&map) + +bool maps__equal(struct maps *a, struct maps *b); + +/* Iterate over map calling cb for each entry. */ +int maps__for_each_map(struct maps *maps, int (*cb)(struct map *map, void *data), void *data); +/* Iterate over map removing an entry if cb returns true. */ +void maps__remove_maps(struct maps *maps, bool (*cb)(struct map *map, void *data), void *data); + +struct machine *maps__machine(const struct maps *maps); +unsigned int maps__nr_maps(const struct maps *maps); /* Test only. */ +refcount_t *maps__refcnt(struct maps *maps); /* Test only. */ + +#ifdef HAVE_LIBUNWIND_SUPPORT +void *maps__addr_space(const struct maps *maps); +void maps__set_addr_space(struct maps *maps, void *addr_space); +uint16_t maps__e_machine(const struct maps *maps); +void maps__set_e_machine(struct maps *maps, uint16_t e_machine); +#endif +#ifdef HAVE_LIBDW_SUPPORT +void *maps__libdw_addr_space_dwfl(const struct maps *maps); +void maps__set_libdw_addr_space_dwfl(struct maps *maps, void *dwfl); +#endif + +size_t maps__fprintf(struct maps *maps, FILE *fp); + +int maps__load_maps(struct maps *maps); +int maps__insert(struct maps *maps, struct map *map); +void maps__remove(struct maps *maps, struct map *map); +int maps__mutate_mapping(struct maps *maps, struct map *map, + int (*mutate_cb)(struct map *map, void *data), void *data); + +struct map *maps__find(struct maps *maps, u64 addr); +struct symbol *maps__find_symbol(struct maps *maps, u64 addr, struct map **mapp); +struct symbol *maps__find_symbol_by_name(struct maps *maps, const char *name, struct map **mapp); + +struct addr_map_symbol; + +int maps__find_ams(struct maps *maps, struct addr_map_symbol *ams); + +int maps__fixup_overlap_and_insert(struct maps *maps, struct map *new); + +struct map *maps__find_by_name(struct maps *maps, const char *name); + +struct map *maps__find_next_entry(struct maps *maps, struct map *map); + +int maps__merge_in(struct maps *kmaps, struct map *new_map); + +void maps__fixup_end(struct maps *maps); + +void maps__load_first(struct maps *maps); + +#endif // __PERF_MAPS_H -- cgit v1.3.1