linux-kernel - Re: staging: r8188eu: struct rt_firmware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 14 Apr 2022 12:08:01 +0200
From:   Michael Straube <straube.linux@...il.com>
To:     David Laight <David.Laight@...LAB.COM>,
        Larry Finger <Larry.Finger@...inger.net>
Cc:     Phillip Potter <phil@...lpotter.co.uk>,
        Greg KH <gregkh@...uxfoundation.org>,
        "open list:STAGING SUBSYSTEM" <linux-staging@...ts.linux.dev>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: staging: r8188eu: struct rt_firmware_header issues

On 4/14/22 10:41, David Laight wrote:
> From: Michael Straube
>> Sent: 13 April 2022 20:42
>>
>> On 4/13/22 18:27, Michael Straube wrote:
>>> Hi all,
>>>
>>> I think the rt_firmware_hdr structure in rtw_fw.c has some issues.
>>>
>>>
>>> struct rt_firmware_hdr {
>>>       /*  8-byte alinment required */
> 
> Probably need an __aligned(8) at the bottom then?

I don't see any reason why this is needed. Do I miss something?

>>>       /*  LONG WORD 0 ---- */
>>>       __le16        Signature;    /* 92C0: test chip; 92C,
>>>                        * 88C0: test chip; 88C1: MP A-cut;
>>>                        * 92C1: MP A-cut */
>>>       u8        Category;    /*  AP/NIC and USB/PCI */
>>>       u8        Function;    /*  Reserved for different FW function
>>>                        *  indcation, for further use when
>>>                        *  driver needs to download different
>>>                        *  FW for different conditions */
>>>       __le16        Version;    /*  FW Version */
>>>       u8        Subversion;    /*  FW Subversion, default 0x00 */
>>>       u16        Rsvd1;
>>>
>>>       /*  LONG WORD 1 ---- */
>>>       u8        Month;    /*  Release time Month field */
>>>       u8        Date;    /*  Release time Date field */
>>>       u8        Hour;    /*  Release time Hour field */
>>>       u8        Minute;    /*  Release time Minute field */
>>>       __le16        RamCodeSize;    /*  The size of RAM code */
>>>       u8        Foundry;
>>>       u8        Rsvd2;
>>>
>>>       /*  LONG WORD 2 ---- */
>>>       __le32        SvnIdx;    /*  The SVN entry index */
>>>       u32        Rsvd3;
>>>
>>>       /*  LONG WORD 3 ---- */
>>>       u32        Rsvd4;
>>>       u32        Rsvd5;
>>> };
> ...
>>
>> Ok, I figured it out by looking at the hexdumps of firmware files. The
>> field Rsvd1 should be u8 instead of u16. I'll prepare a patch for this.
> 
> I'd also add a compile-time assert on the size.

I'll add a patch to the series I recently sent.

thanks,
Michael