diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-08-30 09:26:54 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-08-30 09:26:54 -0700 |
| commit | fb5b59a6a678bab054a78d99eecfdb6f5558e82e (patch) | |
| tree | 5c777bc9b314223fbfc9418fae093d7df571031e | |
| parent | 034dd340b08be1f2f0477ad16131d609f9dbd53c (diff) | |
| parent | 78004e9a87f240df03e2f73120d291763c32e0a7 (diff) | |
Merge tag 'for-linus' of https://github.com/openrisc/linux
Pull OpenRISC updates from Stafford Horne:
"One small trivial macro cleanup and one bug fix.
The bug fix is to fix an unchecked access in our or1k_atomic syscall,
I am debating if we should just deprecate this as there is minimal
need for it"
* tag 'for-linus' of https://github.com/openrisc/linux:
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
openrisc: drop unneeded semicolon
| -rw-r--r-- | arch/openrisc/kernel/entry.S | 43 | ||||
| -rw-r--r-- | arch/openrisc/mm/tlb.c | 4 |
2 files changed, 41 insertions, 6 deletions
diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S index c7e90b09645e..18e68680471e 100644 --- a/arch/openrisc/kernel/entry.S +++ b/arch/openrisc/kernel/entry.S @@ -1223,15 +1223,50 @@ _no_syscall_trace: * */ +/* Keep this literal; hi()/lo() can't use the UL-suffixed TASK_SIZE. */ +#define OR1K_ATOMIC_ADDR_LIMIT 0x7ffffffc + ENTRY(sys_or1k_atomic) /* FIXME: This ignores r3 and always does an XCHG */ + + /* Check both user pointers before accessing them. */ + l.movhi r13,hi(OR1K_ATOMIC_ADDR_LIMIT) + l.ori r13,r13,lo(OR1K_ATOMIC_ADDR_LIMIT) + l.sfgtu r4,r13 + l.bf 9f + l.nop + l.sfgtu r5,r13 + l.bf 9f + l.nop + DISABLE_INTERRUPTS(r17,r19) - l.lwz r29,0(r4) - l.lwz r27,0(r5) - l.sw 0(r4),r27 - l.sw 0(r5),r29 +10: l.lwz r29,0(r4) +11: l.lwz r27,0(r5) +12: l.sw 0(r4),r27 +13: l.sw 0(r5),r29 ENABLE_INTERRUPTS(r17) l.jr r9 l.or r11,r0,r0 + /* + * Either pointer was outside user space, or turned out to be + * unmapped/inaccessible when we actually touched it. + */ +9: l.jr r9 + l.addi r11,r0,-EFAULT + + .section .fixup, "ax" +14: + ENABLE_INTERRUPTS(r17) + l.j 9b + l.nop + .previous + + .section __ex_table, "a" + .long 10b, 14b + .long 11b, 14b + .long 12b, 14b + .long 13b, 14b + .previous + /* ============================================================[ EOF ]=== */ diff --git a/arch/openrisc/mm/tlb.c b/arch/openrisc/mm/tlb.c index 3115f2e4f864..2ee00bf301a4 100644 --- a/arch/openrisc/mm/tlb.c +++ b/arch/openrisc/mm/tlb.c @@ -74,11 +74,11 @@ void local_flush_tlb_all(void) #define flush_dtlb_page_eir(addr) mtspr(SPR_DTLBEIR, addr) #define flush_dtlb_page_no_eir(addr) \ - mtspr_off(SPR_DTLBMR_BASE(0), DTLB_OFFSET(addr), 0); + mtspr_off(SPR_DTLBMR_BASE(0), DTLB_OFFSET(addr), 0) #define flush_itlb_page_eir(addr) mtspr(SPR_ITLBEIR, addr) #define flush_itlb_page_no_eir(addr) \ - mtspr_off(SPR_ITLBMR_BASE(0), ITLB_OFFSET(addr), 0); + mtspr_off(SPR_ITLBMR_BASE(0), ITLB_OFFSET(addr), 0) void local_flush_tlb_page(struct vm_area_struct *vma, unsigned long addr) { |