linux-kernel - Re: [PATCH] rtw89: Fix crash by loading compressed firmware file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 11 Nov 2021 07:31:06 +0100
From:   Takashi Iwai <tiwai@...e.de>
To:     Pkshih <pkshih@...ltek.com>
Cc:     Takashi Iwai <tiwai@...e.de>,
        "kvalo@...eaurora.org" <kvalo@...eaurora.org>,
        "linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
        "Larry.Finger@...il.com" <Larry.Finger@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] rtw89: Fix crash by loading compressed firmware file

On Thu, 11 Nov 2021 03:28:09 +0100,
Pkshih wrote:
> 
> 
> > -----Original Message-----
> > From: Takashi Iwai <tiwai@...e.de>
> > Sent: Friday, November 5, 2021 11:07 PM
> > To: Pkshih <pkshih@...ltek.com>
> > Cc: kvalo@...eaurora.org; linux-wireless@...r.kernel.org; Larry.Finger@...il.com;
> > linux-kernel@...r.kernel.org
> > Subject: Re: [PATCH] rtw89: Fix crash by loading compressed firmware file
> > 
> > 
> > You should put const in the cast in le32_get_bits() invocations, at
> > least.
> > 
> > For the le32_replace_bits(), ideally it should be rewritten in some
> > better way the compiler can catch.  e.g. use an inline function to
> > take a void * argument without const,
> > 
> > static inline void RTW89_SET_FWCMD_CXRFK_TYPE(void *cmd, unsigned int val)
> > {
> > 	le32p_replace_bits((__le32 *)((u8 *)(cmd) + 2), val, GENMASK(17, 10));
> > }
> > 
> > Then the compiler will warn when you pass a const pointer there.
> > 
> 
> I have sent a patchset [1] to do these two things by patch 2 and 3.
> 
> > 
> > BTW, while reading your reply, I noticed that it's an unaligned access
> > to a 32bit value, which is another potential breakage on some
> > architectures.  So the whole stuff has to be rewritten in anyway...
> > 
> 
> We use these macros/inline function on skb->data mostly, and I 
> suppose skb->data is a 32bit aligned address. Since I don't have
> this kind of machine on hand, I would like to defer this work until
> I have one.

I actually misread the code.  The register offset is applied to __le32
pointer, so this should be fine.

> > > partition size we are going to download, and it is only used
> > > by rtw89_fw_download_hdr(). So, I will set the partition size
> > > after copying constant firmware header into skb->data.
> > 
> > Sounds good.
> > 
> 
> Please check if my patch works on your platform.
> Thanks you.
> 
> [1] https://lore.kernel.org/linux-wireless/20211111021457.13776-1-pkshih@realtek.com/T/#t

Thanks.  I'll ask people testing those patches.


Takashi