CVE-2022-50647

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RISC-V: Make port I/O string accessors actually work<br /> <br /> Fix port I/O string accessors such as `insb&amp;#39;, `outsb&amp;#39;, etc. which use<br /> the physical PCI port I/O address rather than the corresponding memory<br /> mapping to get at the requested location, which in turn breaks at least<br /> accesses made by our parport driver to a PCIe parallel port such as:<br /> <br /> PCI parallel port detected: 1415:c118, I/O at 0x1000(0x1008), IRQ 20<br /> parport0: PC-style at 0x1000 (0x1008), irq 20, using FIFO [PCSPP,TRISTATE,COMPAT,EPP,ECP]<br /> <br /> causing a memory access fault:<br /> <br /> Unable to handle kernel access to user memory without uaccess routines at virtual address 0000000000001008<br /> Oops [#1]<br /> Modules linked in:<br /> CPU: 1 PID: 350 Comm: cat Not tainted 6.0.0-rc2-00283-g10d4879f9ef0-dirty #23<br /> Hardware name: SiFive HiFive Unmatched A00 (DT)<br /> epc : parport_pc_fifo_write_block_pio+0x266/0x416<br /> ra : parport_pc_fifo_write_block_pio+0xb4/0x416<br /> epc : ffffffff80542c3e ra : ffffffff80542a8c sp : ffffffd88899fc60<br /> gp : ffffffff80fa2700 tp : ffffffd882b1e900 t0 : ffffffd883d0b000<br /> t1 : ffffffffff000002 t2 : 4646393043330a38 s0 : ffffffd88899fcf0<br /> s1 : 0000000000001000 a0 : 0000000000000010 a1 : 0000000000000000<br /> a2 : ffffffd883d0a010 a3 : 0000000000000023 a4 : 00000000ffff8fbb<br /> a5 : ffffffd883d0a001 a6 : 0000000100000000 a7 : ffffffc800000000<br /> s2 : ffffffffff000002 s3 : ffffffff80d28880 s4 : ffffffff80fa1f50<br /> s5 : 0000000000001008 s6 : 0000000000000008 s7 : ffffffd883d0a000<br /> s8 : 0004000000000000 s9 : ffffffff80dc1d80 s10: ffffffd8807e4000<br /> s11: 0000000000000000 t3 : 00000000000000ff t4 : 393044410a303930<br /> t5 : 0000000000001000 t6 : 0000000000040000<br /> status: 0000000200000120 badaddr: 0000000000001008 cause: 000000000000000f<br /> [] parport_pc_compat_write_block_pio+0xfe/0x200<br /> [] parport_write+0x46/0xf8<br /> [] lp_write+0x158/0x2d2<br /> [] vfs_write+0x8e/0x2c2<br /> [] ksys_write+0x52/0xc2<br /> [] sys_write+0xe/0x16<br /> [] ret_from_syscall+0x0/0x2<br /> ---[ end trace 0000000000000000 ]---<br /> <br /> For simplicity address the problem by adding PCI_IOBASE to the physical<br /> address requested in the respective wrapper macros only, observing that<br /> the raw accessors such as `__insb&amp;#39;, `__outsb&amp;#39;, etc. are not supposed to<br /> be used other than by said macros. Remove the cast to `long&amp;#39; that is no<br /> longer needed on `addr&amp;#39; now that it is used as an offset from PCI_IOBASE<br /> and add parentheses around `addr&amp;#39; needed for predictable evaluation in<br /> macro expansion. No need to make said adjustments in separate changes<br /> given that current code is gravely broken and does not ever work.