Missing privilege check in FWOHCI_WRREG/RDREG ioctl allows operator-group users to write arbitrary OHCI hardware registers

Summary

fwohci_ioctl handler allows reading and writing arbitrary OHCI MMIO registers (up to offset 0x800) and PHY registers via FWOHCI_WRREG/FWOHCI_RDREG/FWOHCI_WRPHYREG/FWOHCI_RDPHYREG without any suser()/priv_check() call. Device node is mode 0660 GID_OPERATOR. Any user in operator group can write arbitrary data to DMA control registers interrupt masks HCC reset register and PHY access enabling controller reset (DoS) DMA redirection to attacker-controlled physical addresses (potential kernel memory access on non-IOMMU systems) and PHY bus disruption. Writable range [0x000 0x800] covers entire OHCI register file including DMA command pointer registers interrupt masks HCCCTL PHYACCESS.