rtw_security: fix cast to restricted __le32

PATCH Superseded Jhih-Ming Huang 3 participants 4 messages Jun 13, 2021 – Jun 18, 2021 Staging

lore

Share & tools

lore

Jhih-Ming Huang

author

2021-06-13 10:22 UTC #0 lore raw

PATCH 1/1 rtw_security: fix cast to restricted __le32

This patch fixes the sparse warning of fix cast to restricted __le32.

Signed-off-by Jhih-Ming Huang <[email protected]>

---
 drivers/staging/rtl8723bs/core/rtw_security.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

drivers/staging/rtl8723bs/core/rtw_security.c +3 -2

index a99f439328f1..2f4da67e31c6 100644
@@ -121,7 +121,7 @@ void rtw_wep_decrypt(struct adapter  *padapter, u8 *precvframe)
 		arc4_crypt(ctx, payload, payload,  length);
 
 		/* calculate icv and compare the icv */
-		*((u32 *)crc) = le32_to_cpu(~crc32_le(~0, payload, length - 4));
+		*((u32 *)crc) = le32_to_cpu((__force __le32)~crc32_le(~0, payload, length - 4));
 
 	}
 }

@@ -618,7 +618,8 @@ u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe)
 			arc4_setkey(ctx, rc4key, 16);
 			arc4_crypt(ctx, payload, payload, length);
 
-			*((u32 *)crc) = le32_to_cpu(~crc32_le(~0, payload, length - 4));
+			*((u32 *)crc) = le32_to_cpu((__force __le32)~crc32_le(~0, payload,
+						length - 4));
 
 			if (crc[3] != payload[length - 1] || crc[2] != payload[length - 2] ||
 			    crc[1] != payload[length - 3] || crc[0] != payload[length - 4])

Signature · 1 line

2.25.1

Greg KH

maintainer

2021-06-13 10:27 UTC #1 lore raw

Quoted 12 lines · Jhih-Ming Huang

This patch fixes the sparse warning of fix cast to restricted __le32.
Signed-off-by Jhih-Ming Huang <[email protected]>
---
 drivers/staging/rtl8723bs/core/rtw_security.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/staging/rtl8723bs/core/rtw_security.c +0 -0
index a99f439328f1..2f4da67e31c6 100644

drivers/staging/rtl8723bs/core/rtw_security.c void rtw_wep_decrypt(struct adapter *padapter, u8 *precvframe) · line 124

Quoted 5 lines

drivers/staging/rtl8723bs/core/rtw_security.c +1 -1

@@ -121,7 +121,7 @@ void rtw_wep_decrypt(struct adapter  *padapter, u8 *precvframe)
 		arc4_crypt(ctx, payload, payload,  length);
 
 		/* calculate icv and compare the icv */
-		*((u32 *)crc) = le32_to_cpu(~crc32_le(~0, payload, length - 4));
+		*((u32 *)crc) = le32_to_cpu((__force __le32)~crc32_le(~0, payload, length - 4));

When you use __force, that usually implies something is wrong here.

Look at the recent changes that were just submitted for this a week or so ago in the mailing list archives, and the discussion about them, to see the issues involved here.

I would need to see a _LOT_ of description in the changelog about why these changes are actually correct, before I can take them.

thanks,

greg k-h

David Laight

2021-06-14 20:48 UTC #2 lore raw

In reply to Jhih-Ming Huang

From: Jhih-Ming Huang

Quoted 24 lines

Sent: 13 June 2021 11:22

This patch fixes the sparse warning of fix cast to restricted __le32.

Signed-off-by Jhih-Ming Huang <[email protected]>

---
 drivers/staging/rtl8723bs/core/rtw_security.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

drivers/staging/rtl8723bs/core/rtw_security.c +1 -1

index a99f439328f1..2f4da67e31c6 100644
@@ -121,7 +121,7 @@ void rtw_wep_decrypt(struct adapter  *padapter, u8 *precvframe)
 		arc4_crypt(ctx, payload, payload,  length);
 
 		/* calculate icv and compare the icv */
-		*((u32 *)crc) = le32_to_cpu(~crc32_le(~0, payload, length - 4));
+		*((u32 *)crc) = le32_to_cpu((__force __le32)~crc32_le(~0, payload, length - 4));
 
 	}
 }

drivers/staging/rtl8723bs/core/rtw_security.c u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe) · line 619

Quoted 2 lines

drivers/staging/rtl8723bs/core/rtw_security.c +0 -0

@@ -618,7 +618,8 @@ u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe)
 			arc4_setkey(ctx, rc4key, 16);
 			arc4_crypt(ctx, payload, payload, length);

Is someone using 'rc4' and 'security' in the same file?

drivers/staging/rtl8723bs/core/rtw_security.c u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe) · line 625

Quoted 7 lines

drivers/staging/rtl8723bs/core/rtw_security.c +2 -1

-			*((u32 *)crc) = le32_to_cpu(~crc32_le(~0, payload, length - 4));
+			*((u32 *)crc) = le32_to_cpu((__force __le32)~crc32_le(~0, payload,
+						length - 4));
 
 			if (crc[3] != payload[length - 1] || crc[2] != payload[length - 2] ||
 			    crc[1] != payload[length - 3] || crc[0] != payload[length - 4])

In both cases the *((u32 *)crc) is also very dubious. Casts of pointers to integer types are almost always broken. Given the code that follows the second hunk I'm guessing you have 'u8 crc[4];' (or equivalent).
That can be misaligned and then access will panic on some systems.

There is a get_unaligned_be32() (or something similar) that can be used to read the crc from (payload + length - 4).

David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)

Jhih Ming Huang

author

2021-06-18 18:37 UTC #3 lore raw

Quoted 23 lines · David Laight

From: Jhih-Ming Huang

Quoted 21 lines

Sent: 13 June 2021 11:22

This patch fixes the sparse warning of fix cast to restricted __le32.

Signed-off-by Jhih-Ming Huang <[email protected]>

---
 drivers/staging/rtl8723bs/core/rtw_security.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

drivers/staging/rtl8723bs/core/rtw_security.c +1 -1

index a99f439328f1..2f4da67e31c6 100644
@@ -121,7 +121,7 @@ void rtw_wep_decrypt(struct adapter  *padapter, u8 *precvframe)
              arc4_crypt(ctx, payload, payload,  length);
 
              /* calculate icv and compare the icv */
-             *((u32 *)crc) = le32_to_cpu(~crc32_le(~0, payload, length - 4));
+             *((u32 *)crc) = le32_to_cpu((__force __le32)~crc32_le(~0, payload, length - 4));

Quoted 7 lines

drivers/staging/rtl8723bs/core/rtw_security.c u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe) · line 619
Quoted 5 lines
drivers/staging/rtl8723bs/core/rtw_security.c +0 -0
      }
 }
@@ -618,7 +618,8 @@ u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe)
                      arc4_setkey(ctx, rc4key, 16);
                      arc4_crypt(ctx, payload, payload, length);
Is someone using 'rc4' and 'security' in the same file?

Sorry, I don't get it. Could you explain it more? thanks.

Quoted 6 lines

drivers/staging/rtl8723bs/core/rtw_security.c +2 -1

-                     *((u32 *)crc) = le32_to_cpu(~crc32_le(~0, payload, length - 4));
+                     *((u32 *)crc) = le32_to_cpu((__force __le32)~crc32_le(~0, payload,
+                                             length - 4));

Quoted 9 lines

drivers/staging/rtl8723bs/core/rtw_security.c u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe) · line 625
Quoted 2 lines
drivers/staging/rtl8723bs/core/rtw_security.c +0 -0
                      if (crc[3] != payload[length - 1] || crc[2] != payload[length - 2] ||
                          crc[1] != payload[length - 3] || crc[0] != payload[length - 4])
In both cases the *((u32 *)crc) is also very dubious. Casts of pointers to integer types are almost always broken. Given the code that follows the second hunk I'm guessing you have 'u8 crc[4];' (or equivalent).
That can be misaligned and then access will panic on some systems.

yes, I've sent the v3 PATCH and used Al Viro's suggestions.

Quoted 2 lines

There is a get_unaligned_be32() (or something similar) that can be used to read the crc from (payload + length - 4).

I also used memcmp for checking.

thanks.

--jmhuang

Quoted 7 lines

David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)