Fix pairing PIN security vulnerability - [merged]

[eggroll-bot]

Merges pairing-security-fix -> main

This security vulnerability is due to the fact that the pairing PIN response delay is only done when the PIN is wrong. This merge request makes it so that there is always a delay.

[eggroll-bot]

requested review from @jzhan357

[eggroll-bot]

requested review from @MelonShooter and removed review request for @jzhan357

[eggroll-bot]

In GitLab by @MelonShooter on Mar 5, 2023, 23:16

Commented on docker_env/util_no_std/src/runtime.rs line 120

Don't fully qualify these things and don't specify the trait the ptr() associated function comes from. It's unnecessary if you import the trait

[eggroll-bot]

In GitLab by @MelonShooter on Mar 5, 2023, 23:16

Commented on docker_env/util_no_std/src/runtime.rs line 152

Why do you grow in here when you allocate in the From implementation for RuntimePeripherals.

Also, you need to be careful here because to use a static mut without synchronized access, you must ensure that it is only ever accessed on a single thread throughout its lifetime.

[eggroll-bot]

In GitLab by @MelonShooter on Mar 5, 2023, 23:16

Commented on fob/src/pairing.rs line 68

This tuple literal is incredibly difficult to read, separate the creation of the HibTimer out into another variable

[eggroll-bot]

In GitLab by @MelonShooter on Mar 5, 2023, 23:16

Commented on fob/src/pairing.rs line 140

Put this stuff into a separate function without the while !pin_cooldown_timer.poll() {} and call it here. Then, run that line after the function returns. This way, you can ensure that it waits for the timer on all exit paths much easier.

[eggroll-bot]

added 5 commits

• b7b1bb5f...8bad1dd7 - 4 commits from branch main
• e2073a2c - Fix pairing PIN security vulnerability

Compare with previous version

[eggroll-bot]

changed this line in version 3 of the diff

[eggroll-bot]

changed this line in version 3 of the diff

[eggroll-bot]

added 1 commit

• 6266cc4e - Fix suggestions

Compare with previous version

[eggroll-bot]

In GitLab by @MelonShooter on Mar 6, 2023, 02:14

Commented on docker_env/util_no_std/src/runtime.rs line 319

You must add dsb() (dmb() is probably fine too) after this to ensure all threads see this because RuntimePeripherals is Send. Technically we're in a single-threaded safe environment but it's not safe otherwise. This isn't necessary b/c the Arc is allocated in the thread.

[eggroll-bot]

You don't need a memory barrier. The arc is created in the same function.

[eggroll-bot]

resolved all threads

[eggroll-bot]

In GitLab by @MelonShooter on Mar 6, 2023, 02:23

approved this merge request

[eggroll-bot]

added 1 commit

• 0100a5f4 - Fix pairing PIN timeout

Compare with previous version