linux-kernel - RE: [PATCH] rtw89: Fix crash by loading compressed firmware file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 11 Nov 2021 02:28:09 +0000
From:   Pkshih <pkshih@...ltek.com>
To:     Takashi Iwai <tiwai@...e.de>
CC:     "kvalo@...eaurora.org" <kvalo@...eaurora.org>,
        "linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
        "Larry.Finger@...il.com" <Larry.Finger@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] rtw89: Fix crash by loading compressed firmware file


> -----Original Message-----
> From: Takashi Iwai <tiwai@...e.de>
> Sent: Friday, November 5, 2021 11:07 PM
> To: Pkshih <pkshih@...ltek.com>
> Cc: kvalo@...eaurora.org; linux-wireless@...r.kernel.org; Larry.Finger@...il.com;
> linux-kernel@...r.kernel.org
> Subject: Re: [PATCH] rtw89: Fix crash by loading compressed firmware file
> 
> 
> You should put const in the cast in le32_get_bits() invocations, at
> least.
> 
> For the le32_replace_bits(), ideally it should be rewritten in some
> better way the compiler can catch.  e.g. use an inline function to
> take a void * argument without const,
> 
> static inline void RTW89_SET_FWCMD_CXRFK_TYPE(void *cmd, unsigned int val)
> {
> 	le32p_replace_bits((__le32 *)((u8 *)(cmd) + 2), val, GENMASK(17, 10));
> }
> 
> Then the compiler will warn when you pass a const pointer there.
> 

I have sent a patchset [1] to do these two things by patch 2 and 3.

> 
> BTW, while reading your reply, I noticed that it's an unaligned access
> to a 32bit value, which is another potential breakage on some
> architectures.  So the whole stuff has to be rewritten in anyway...
> 

We use these macros/inline function on skb->data mostly, and I 
suppose skb->data is a 32bit aligned address. Since I don't have
this kind of machine on hand, I would like to defer this work until
I have one.

> 
> > The macro SET_FW_HDR_PART_SIZE() is used to set the firmware
> > partition size we are going to download, and it is only used
> > by rtw89_fw_download_hdr(). So, I will set the partition size
> > after copying constant firmware header into skb->data.
> 
> Sounds good.
> 

Please check if my patch works on your platform.
Thanks you.

[1] https://lore.kernel.org/linux-wireless/20211111021457.13776-1-pkshih@realtek.com/T/#t

--
Ping-Ke