From 78004e9a87f240df03e2f73120d291763c32e0a7 Mon Sep 17 00:00:00 2001 From: Ali Ahmet Memis Date: Fri, 21 Aug 2026 01:45:27 +0000 Subject: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries. A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly. This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context. Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT. [shorne@gmail.com: fix comment style] Fixes: 9d02a4283e9c ("OpenRISC: Boot code") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis Signed-off-by: Stafford Horne --- usr/dummy-include/endian.h | 0 usr/dummy-include/limits.h | 8 ++++++++ usr/dummy-include/netinet/if_ether.h | 0 usr/dummy-include/netinet/in.h | 0 usr/dummy-include/stddef.h | 13 +++++++++++++ usr/dummy-include/stdint.h | 17 +++++++++++++++++ usr/dummy-include/string.h | 12 ++++++++++++ usr/dummy-include/sys/ioctl.h | 0 usr/dummy-include/sys/socket.h | 12 ++++++++++++ usr/dummy-include/sys/time.h | 3 +++ usr/dummy-include/sys/types.h | 0 usr/dummy-include/time.h | 0 usr/dummy-include/unistd.h | 0 13 files changed, 65 insertions(+) create mode 100644 usr/dummy-include/endian.h create mode 100644 usr/dummy-include/limits.h create mode 100644 usr/dummy-include/netinet/if_ether.h create mode 100644 usr/dummy-include/netinet/in.h create mode 100644 usr/dummy-include/stddef.h create mode 100644 usr/dummy-include/stdint.h create mode 100644 usr/dummy-include/string.h create mode 100644 usr/dummy-include/sys/ioctl.h create mode 100644 usr/dummy-include/sys/socket.h create mode 100644 usr/dummy-include/sys/time.h create mode 100644 usr/dummy-include/sys/types.h create mode 100644 usr/dummy-include/time.h create mode 100644 usr/dummy-include/unistd.h (limited to 'usr/dummy-include') diff --git a/usr/dummy-include/endian.h b/usr/dummy-include/endian.h new file mode 100644 index 000000000..e69de29bb diff --git a/usr/dummy-include/limits.h b/usr/dummy-include/limits.h new file mode 100644 index 000000000..49b17c10c --- /dev/null +++ b/usr/dummy-include/limits.h @@ -0,0 +1,8 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef _DUMMY_LIMITS_H +#define _DUMMY_LIMITS_H + +#define INT_MAX ((int)(~0U >> 1)) +#define INT_MIN (-INT_MAX - 1) + +#endif /* _DUMMY_LIMITS_H */ diff --git a/usr/dummy-include/netinet/if_ether.h b/usr/dummy-include/netinet/if_ether.h new file mode 100644 index 000000000..e69de29bb diff --git a/usr/dummy-include/netinet/in.h b/usr/dummy-include/netinet/in.h new file mode 100644 index 000000000..e69de29bb diff --git a/usr/dummy-include/stddef.h b/usr/dummy-include/stddef.h new file mode 100644 index 000000000..525489daf --- /dev/null +++ b/usr/dummy-include/stddef.h @@ -0,0 +1,13 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef _DUMMY_STDDEF_H +#define _DUMMY_STDDEF_H + +#define offsetof(TYPE, MEMBER) __builtin_offsetof(TYPE, MEMBER) + +#ifdef __cplusplus +#define NULL 0 +#else +#define NULL ((void *)0) +#endif + +#endif /* _DUMMY_STDDEF_H */ diff --git a/usr/dummy-include/stdint.h b/usr/dummy-include/stdint.h new file mode 100644 index 000000000..93b1962fd --- /dev/null +++ b/usr/dummy-include/stdint.h @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef _DUMMY_STDINT_H +#define _DUMMY_STDINT_H + +#include + +typedef __u64 uint64_t; +typedef __u32 uint32_t; +typedef __u16 uint16_t; +typedef __u8 uint8_t; + +typedef __s64 int64_t; +typedef __s32 int32_t; +typedef __s16 int16_t; +typedef __s8 int8_t; + +#endif /* _DUMMY_STDINT_H */ diff --git a/usr/dummy-include/string.h b/usr/dummy-include/string.h new file mode 100644 index 000000000..e059808d3 --- /dev/null +++ b/usr/dummy-include/string.h @@ -0,0 +1,12 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef _DUMMY_STRING_H +#define _DUMMY_STRING_H + +#include + +#define memset(_s, _c, _n) __builtin_memset(_s, _c, _n) +#define memcpy(_dest, _src, _n) __builtin_memcpy(_dest, _src, _n) + +#define strlen(_s) __builtin_strlen(_s) + +#endif /* _DUMMY_STRING_H */ diff --git a/usr/dummy-include/sys/ioctl.h b/usr/dummy-include/sys/ioctl.h new file mode 100644 index 000000000..e69de29bb diff --git a/usr/dummy-include/sys/socket.h b/usr/dummy-include/sys/socket.h new file mode 100644 index 000000000..748751f9e --- /dev/null +++ b/usr/dummy-include/sys/socket.h @@ -0,0 +1,12 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef _DUMMY_SYS_SOCKET_H +#define _DUMMY_SYS_SOCKET_H + +#include + +struct sockaddr { + __kernel_sa_family_t sa_family; /* address family, AF_xxx */ + char sa_data[14]; /* 14 bytes of protocol address */ +}; + +#endif /* _DUMMY_SYS_SOCKET_H */ diff --git a/usr/dummy-include/sys/time.h b/usr/dummy-include/sys/time.h new file mode 100644 index 000000000..9817b8afb --- /dev/null +++ b/usr/dummy-include/sys/time.h @@ -0,0 +1,3 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#include diff --git a/usr/dummy-include/sys/types.h b/usr/dummy-include/sys/types.h new file mode 100644 index 000000000..e69de29bb diff --git a/usr/dummy-include/time.h b/usr/dummy-include/time.h new file mode 100644 index 000000000..e69de29bb diff --git a/usr/dummy-include/unistd.h b/usr/dummy-include/unistd.h new file mode 100644 index 000000000..e69de29bb -- cgit v1.3.1