linux-kernel - Re: [PATCH 5/5] staging: r8188eu: turbo scan is always off for r8188eu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 4 Jan 2022 23:52:53 +0300
From:   Pavel Skripkin <paskripkin@...il.com>
To:     Martin Kaiser <martin@...ser.cx>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Larry Finger <Larry.Finger@...inger.net>,
        Phillip Potter <phil@...lpotter.co.uk>,
        Michael Straube <straube.linux@...il.com>,
        linux-staging@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 5/5] staging: r8188eu: turbo scan is always off for
 r8188eu

On 1/4/22 23:51, Martin Kaiser wrote:
> Hi Pavel,
> 
> Thus wrote Pavel Skripkin (paskripkin@...il.com):
> 
>> It's a bit unrelated to the patch, but I found it while reviewing this. It's
>> in the same function rtl8188e_PHY_RF6052SetCckTxPower():
> 
>> 89: 	u32 TxAGC[2] = {0, 0};
>> ...
>> 92	u8 *ptr;
>> ...
>> 129	for (idx1 = RF_PATH_A; idx1 <= RF_PATH_B; idx1++) {
>> 130		ptr = (u8 *)(&TxAGC[idx1]);
>> 131		for (idx2 = 0; idx2 < 4; idx2++) {
>> 132			if (*ptr > RF6052_MAX_TX_PWR)
>> 133				*ptr = RF6052_MAX_TX_PWR;
>> 134			ptr++;
>> 135		}
>> 136	}
> 
> 
>> What is going on here? Code just checks and writes to random place on stack
>> outside TxAGC array? I might be missing something, but it looks wrong...
> 
> TxAGC is two 32-bit values, i.e. 2 x 4 Bytes. The outer loop selects a
> 32-bit array entry, the inner loop iterates over each byte of this entry
> and checks that it is <= RF6052_MAX_TX_PWR. I don't think this writes past
> the end of the TxAGC[] array.
> 

Oh.... I should have go to sleep earlier that evening, sorry. I've 
missed, that this array is u32, but not u8.

Sorry for that noise :(




With regards,
Pavel Skripkin