From 78004e9a87f240df03e2f73120d291763c32e0a7 Mon Sep 17 00:00:00 2001 From: Ali Ahmet Memis Date: Fri, 21 Aug 2026 01:45:27 +0000 Subject: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries. A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly. This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context. Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT. [shorne@gmail.com: fix comment style] Fixes: 9d02a4283e9c ("OpenRISC: Boot code") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis Signed-off-by: Stafford Horne --- tools/perf/util/trace-event.c | 118 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 118 insertions(+) create mode 100644 tools/perf/util/trace-event.c (limited to 'tools/perf/util/trace-event.c') diff --git a/tools/perf/util/trace-event.c b/tools/perf/util/trace-event.c new file mode 100644 index 000000000..6a8c66c64 --- /dev/null +++ b/tools/perf/util/trace-event.c @@ -0,0 +1,118 @@ +// SPDX-License-Identifier: GPL-2.0 +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "trace-event.h" +#include "machine.h" + +/* + * global trace_event object used by trace_event__tp_format + * + * TODO There's no cleanup call for this. Add some sort of + * __exit function support and call trace_event__cleanup + * there. + */ +static struct trace_event tevent; +static bool tevent_initialized; + +int trace_event__init(struct trace_event *t) +{ + struct tep_handle *pevent = tep_alloc(); + + if (pevent) { + t->plugin_list = tep_load_plugins(pevent); + t->pevent = pevent; + } + + return pevent ? 0 : -1; +} + +static int trace_event__init2(void) +{ + int be = tep_is_bigendian(); + struct tep_handle *pevent; + + if (trace_event__init(&tevent)) + return -1; + + pevent = tevent.pevent; + tep_set_flag(pevent, TEP_NSEC_OUTPUT); + tep_set_file_bigendian(pevent, be); + tep_set_local_bigendian(pevent, be); + tevent_initialized = true; + return 0; +} + +int trace_event__register_resolver(struct machine *machine, + tep_func_resolver_t *func) +{ + if (!tevent_initialized && trace_event__init2()) + return -1; + + return tep_set_function_resolver(tevent.pevent, func, machine); +} + +void trace_event__cleanup(struct trace_event *t) +{ + tep_unload_plugins(t->plugin_list, t->pevent); + tep_free(t->pevent); +} + +/* + * Returns pointer with encoded error via interface. + */ +static struct tep_event* +tp_format(const char *sys, const char *name) +{ + char *tp_dir = get_events_file(sys); + struct tep_handle *pevent = tevent.pevent; + struct tep_event *event = NULL; + char path[PATH_MAX]; + size_t size; + char *data; + int err; + + if (!tp_dir) + return ERR_PTR(-errno); + + scnprintf(path, PATH_MAX, "%s/%s/format", tp_dir, name); + put_events_file(tp_dir); + + err = filename__read_str(path, &data, &size); + if (err) + return ERR_PTR(err); + + tep_parse_format(pevent, &event, data, size, sys); + + free(data); + return event; +} + +/* + * Returns pointer with encoded error via interface. + */ +struct tep_event* +trace_event__tp_format(const char *sys, const char *name) +{ + if (!tevent_initialized && trace_event__init2()) + return ERR_PTR(-ENOMEM); + + return tp_format(sys, name); +} + +struct tep_event *trace_event__tp_format_id(int id) +{ + if (!tevent_initialized && trace_event__init2()) + return ERR_PTR(-ENOMEM); + + return tep_find_event(tevent.pevent, id); +} -- cgit v1.3.1