[PATCH 2/2] firmware_loader: fix soundness issue in `request_internal`
From: Danilo Krummrich
Date: Sat Jul 06 2024 - 20:39:21 EST
`request_internal` must be called with one of the following function
pointers: request_firmware(), firmware_request_nowarn(),
firmware_request_platform() or request_firmware_direct().
The previous `FwFunc` alias did not guarantee this, which is unsound.
In order to fix this up, implement `FwFunc` as new type with a
corresponding type invariant and unsafe `new` function.
Reported-by: Gary Guo <gary@xxxxxxxxxxx>
Closes: https://lore.kernel.org/lkml/20240620143611.7995e0bb@eugeo/
Signed-off-by: Danilo Krummrich <dakr@xxxxxxxxxx>
---
rust/kernel/firmware.rs | 32 ++++++++++++++++++++++++++------
1 file changed, 26 insertions(+), 6 deletions(-)
diff --git a/rust/kernel/firmware.rs b/rust/kernel/firmware.rs
index 106a928a535e..d765ecc85d38 100644
--- a/rust/kernel/firmware.rs
+++ b/rust/kernel/firmware.rs
@@ -7,11 +7,24 @@
use crate::{bindings, device::Device, error::Error, error::Result, str::CStr};
use core::ptr::NonNull;
-// One of the following: `bindings::request_firmware`, `bindings::firmware_request_nowarn`,
-// `firmware_request_platform`, `bindings::request_firmware_direct`
-type FwFunc =
+type RawFwFunc =
unsafe extern "C" fn(*mut *const bindings::firmware, *const i8, *mut bindings::device) -> i32;
+/// # Invariants
+///
+/// One of the following: `bindings::request_firmware`, `bindings::firmware_request_nowarn`,
+/// `firmware_request_platform`, `bindings::request_firmware_direct`
+struct FwFunc(RawFwFunc);
+
+impl FwFunc {
+ /// # Safety
+ ///
+ /// Must be one of the functions listed in the type invariants.
+ unsafe fn from_raw(func: RawFwFunc) -> Self {
+ Self(func)
+ }
+}
+
/// Abstraction around a C `struct firmware`.
///
/// This is a simple abstraction around the C firmware API. Just like with the C API, firmware can
@@ -48,7 +61,7 @@ fn request_internal(name: &CStr, dev: &Device, func: FwFunc) -> Result<Self> {
// SAFETY: `pfw` is a valid pointer to a NULL initialized `bindings::firmware` pointer.
// `name` and `dev` are valid as by their type invariants.
- let ret = unsafe { func(pfw as _, name.as_char_ptr(), dev.as_raw()) };
+ let ret = unsafe { func.0(pfw as _, name.as_char_ptr(), dev.as_raw()) };
if ret != 0 {
return Err(Error::from_errno(ret));
}
@@ -60,13 +73,20 @@ fn request_internal(name: &CStr, dev: &Device, func: FwFunc) -> Result<Self> {
/// Send a firmware request and wait for it. See also `bindings::request_firmware`.
pub fn request(name: &CStr, dev: &Device) -> Result<Self> {
- Self::request_internal(name, dev, bindings::request_firmware)
+ // SAFETY: `bindings::request_firmware` is valid by the safety requirement of `FwFunc`.
+ let func = unsafe { FwFunc::from_raw(bindings::request_firmware) };
+
+ Self::request_internal(name, dev, func)
}
/// Send a request for an optional firmware module. See also
/// `bindings::firmware_request_nowarn`.
pub fn request_nowarn(name: &CStr, dev: &Device) -> Result<Self> {
- Self::request_internal(name, dev, bindings::firmware_request_nowarn)
+ // SAFETY: `bindings::firmware_request_nowarn` is valid by the safety requirement of
+ // `FwFunc::new`.
+ let func = unsafe { FwFunc::from_raw(bindings::firmware_request_nowarn) };
+
+ Self::request_internal(name, dev, func)
}
fn as_raw(&self) -> *mut bindings::firmware {
--
2.45.2