fix(core/bootloader): mark check_vendor_header_lock warn-unused-result
What the developer wrote
Authored by tychovrahe
fix(core/bootloader): mark check_vendor_header_lock warn-unused-result
The three sibling checks in sec/image.h -- check_vendor_header_model, _sig
and _keys -- are all declared `secbool __wur (const vendor_header *const)`.
This one predates them in that respect and had neither the attribute nor the
second const, even though dropping its result would silently skip an
authorization check rather than fail.
No call site changes: both existing callers already consume the value (one
assigns it, one wraps it in ensure()).
[no changelog]
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
What changed, and why it matters
This is a small hardening change to the Trezor bootloader. It adds a compiler warning attribute to a security check function so that future programmers cannot accidentally call it and ignore its pass/fail result. The current code already uses the result correctly at both call sites, so there is no active bug being fixed—only prevention of a future mistake.
Treat as a low-risk hardening patch. No urgent action is required because current callers already handle the return value. Review whether any other bootloader security functions returning secbool lack __wur and consider applying the same pattern consistently.
Security signals we found
Authorization check result could be silently dropped without compiler warning
Function added warn-unused-result attribute to match sibling security checks
No call-site changes because existing callers already consume the return value
Bootloader code path involved in firmware vendor authorization
Evidence from the diff
The patch marks check_vendor_header_lock with __wur (warn-unused-result) and adds a second const qualifier to its pointer parameter, matching three sibling functions in sec/image.h. The function verifies that a vendor header in flash matches an OTP lock; ignoring its return value would skip an authorization check. Both existing callers in the bootloader already consume the returned secbool (one assigns it, one passes it to ensure()), so the change is defensive and does not alter runtime behavior.
Changed components
core/embed/projects/bootloader/fw_check.ccore/embed/projects/bootloader/fw_check.hTrezor Core bootloader vendor-header lock verificationInspect captured patch +2 / −2
### core/embed/projects/bootloader/fw_check.c
@@ -32,7 +32,7 @@
#include "emulator.h"
#endif
-secbool check_vendor_header_lock(const vendor_header *vhdr) {
+secbool check_vendor_header_lock(const vendor_header *const vhdr) {
uint8_t lock[FLASH_OTP_BLOCK_SIZE];
ensure(flash_otp_read(FLASH_OTP_BLOCK_VENDOR_HEADER_LOCK, 0, lock,
FLASH_OTP_BLOCK_SIZE),
### core/embed/projects/bootloader/fw_check.h
@@ -74,7 +74,7 @@ firmware image is present. */
* @return sectrue when the vendor header is the same or there is no lock;
* secfalse otherwise.
*/
-secbool check_vendor_header_lock(const vendor_header *vhdr);
+secbool __wur check_vendor_header_lock(const vendor_header *const vhdr);
/**
* @brief Perform comprehensive verification of the firmware image availableWhy this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.