Add comprehensive documentation for the iptables command including
all supported commands, options, and usage examples.
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
Add comprehensive documentation for the ip6tables command including
all supported commands, options, and IPv6-specific usage examples.
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
Remove implicit default credentials and add build-time validation.
Add check_passwd_keys.sh and gen_passwd_keys.sh; run key setup via
passwd_keys.mk before config.h is generated. Mirror the same logic in
cmake/nuttx_add_romfs.cmake for CMake builds.
BREAKING CHANGE: Builds with CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE=y now
require an explicit admin password and non-default TEA keys. The
Kconfig default password "Administrator" and default TEA keys are no
longer accepted. Fix: run make menuconfig, set Admin password under
Board Selection -> Auto-generate /etc/passwd, enable random TEA keys or
set CONFIG_FSUTILS_PASSWD_KEY1..4 manually, and use NSH login with
Encrypted password file verification.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
GS2200M response parsing copies device-provided text fields into fixed-size local buffers.
Add field widths to the sscanf string conversions so the parsed address, port, and command fields stay within their destination arrays.
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
Limit the parsed TXTABLE name field to NAME_MAX and reject entries that do not provide all three required fields. This avoids writing past struct partition_s.name when a text partition table contains an overlong name.
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
PWMIOC_ENABLE_LED_BANK_MODE uses the provided LED number to index the LP503X led_mode array. Reject values outside the RGB LED range before writing that array.
Generated-by: OpenAI Codex
Signed-off-by: aineoae86-sys <ai.neo.ae86@gmail.com>
All I2S driver operation functions say in their signature description
that negative errno values are returned on failure. However, some of
these same functions had `uint32_t` return types. This would result in
incorrect comparison of the return value against signed error code
values.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
pci_epf_device_register() and pci_epf_unregister_driver() used || in DEBUGASSERT expressions that validate a pointer and a required field or callback. If the pointer is NULL, the right-hand side dereferences it; if the pointer is valid but the required member is NULL, the assertion passes.
Require both conditions in each assertion so the debug checks match the preconditions used later in the functions.
Generated-by: OpenAI Codex
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
When several RNDIS responses are queued, the control request handler sends one complete response if the host wLength is smaller than the whole queue. If the first queued response is also larger than wLength, copying hdr->msglen bytes would overrun the requested transfer and the completion path would consume a partial message.
Return EMSGSIZE before copying in that case so the queued response remains intact for a retry with a large enough wLength.
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
pci_epc_map_msi_irq() used && when checking the EPC pointer and map_msi_irq callback. If epc is NULL, the right-hand side dereferences it; if the callback is NULL on a valid EPC, the guard does not reject it before the call.
Match the surrounding EPC wrappers by rejecting a NULL EPC, an out-of-range function number, or a missing map_msi_irq callback before taking the lock and invoking the operation.
Generated-by: OpenAI Codex
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
Check the provided length before reading the current lowoutstream byte. This avoids reading past zero-length or fully consumed buffers before the loop condition stops.
Generated-by: OpenAI Codex
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
EEPROM_DS_COUNT is the number of supported DS2XXX device types and is used as the size of the EEPROM geometry tables. Reject it before storing the device type for later table indexing.
Generated-by: OpenAI Codex
Signed-off-by: aineoae86-sys <ai.neo.ae86@gmail.com>
Limit modem version tokens parsed from AT command responses to the LTE version field sizes. Also require both HWVERSION fields before copying them so a partial parse does not read an uninitialized temporary buffer.
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
The XMC_VADC_* constants describe counts, so the valid register, group, and channel indexes are below those values. The current checks allow the count itself through and then use it to index VADC group, channel, and result registers.
Reject those boundary values before the register array access.
Generated-by: OpenAI Codex
Signed-off-by: aineoae86-sys <ai.neo.ae86@gmail.com>
the timers example causes the following error:
iscv-none-elf-ld: /github/workspace/sources/nuttx/staging/libapps.a(timer_main.c.github.workspace.sources.apps.examples.timer_1.o): in function timer_main:
/github/workspace/sources/apps/examples/timer/timer_main.c:209:(.text.timer_main+0x1c2): undefined reference to sigaction
riscv-none-elf-ld: /github/workspace/sources/apps/examples/timer/timer_main.c:278:(.text.timer_main+0x30e): undefined reference to sigaction
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
If this configuration is enabled it will cause the build error
riscv-none-elf-ld: /github/workspace/sources/nuttx/nuttx section .text will not fit in region ilm
riscv-none-elf-ld: region ilm overflowed by 976 bytes
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
Add more refined options for sched/misc/assert to control how verbose
crash dumps are printed out:
- SCHED_DUMP_TASKS
- SCHED_DUMP_STACK
These default to y unless DEFAULT_SMALL is defined. The options can
be undefined to save flash space on a small system.
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
- Use shared string for "stack pointer out of range" to avoid duplicate in flash
- Re-use already calculated stack_used instead of calling up_check_tcbstack again
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
Replace the per-family stm32_get_uniqueid() implementations and the two
IP-versioned common variants with a single generic byte-array reader,
arch/arm/src/common/stm32/stm32_uid.c.
BREAKING CHANGE for STM32 M0 families: stm32_get_uniqueid() now always
takes a uint8_t[12] buffer.
Out-of-tree Cortex-M0 code that used the previous prototype
"void stm32_get_uniqueid(uint32_t *uid)" must change its buffer to
"uint8_t uniqueid[12]".
Signed-off-by: raiden00pl <raiden00@railab.me>
This commit updates Espressif's common source code to ensure that
critical sections are properly handled by the common source code.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
The fence.i instruction is only available when the Zifencei extension
(CONFIG_ARCH_RV_ISA_ZICSR_ZIFENCEI) is supported by the hardware.
This commit adds a macro wrapper around fence.i usages to prevent
compilation errors on toolchains or targets where the Zifencei
extension is absent.
Signed-off-by: Chengdong Wang <wangcd91@gmail.com>
Includes a defconfig to play NXDoom on the simulator. Keyboard input is
available through X11, as well as graphics rendering. The `/data` folder
is used as the default home for game files.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
Includes documentation about the current state of the DOOM port, where
it came from, how to play and what the requirements are. Includes all of
the warnings about experimental/unfinished features.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
The existing first-order LCG (seed = 470001 * seed % 999563) has several
quality problems:
- Output range limited to [1, 999562] (~20 bits) instead of full 32-bit
- Lower bits have very short periods (8-bit period = 1, 16-bit = 105)
- Overall period only ~1M, far too short for many applications
- Causes mbedtls_rsa_gen_key to loop forever when rand() consumption
aligns with the cycle length (issue #16760)
Replace the entire order-based LCG implementation (CONFIG_LIBC_RAND_ORDER
0-3) with Marsaglia's xorshift32:
- Full 32-bit output range
- Period 2^32 - 1 (~4.29 billion)
- Fast: just three XOR/shift operations
- No floating-point math needed
- No CONFIG_LIBC_RAND_ORDER configuration required
Remove the CONFIG_LIBC_RAND_ORDER Kconfig option and clean up all
defconfig references (12 boards) and related comments.
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
An unchecked integer assignment in the CAN driver may result in a division-by-zero which would result in a kernel crash (denial of service).
Tested locally, builds fine.
An unchecked integer assignment in the CAN driver may result in a division-by-zero which would result in a kernel crash (denial of service).
The CAN driver `can_ioctl` function, shown below (drivers/can/can.c), receives commands from user processes. Its received arguments `cmd` and content of `arg` are under attacker's control. In the CAN driver, some `ioctl` commands are hardware specific and are processed by calling `dev_ioctl()`. Subsequently, depending on the hardware (STM32 or AT32), this function calls `fdcan_ioctl` or `at32can_ioctl`, as shown in the snippets that follow.
```c
static int can_ioctl(FAR struct file *filep, int cmd, unsigned long arg)
{
FAR struct inode *inode = filep->f_inode;
FAR struct can_dev_s *dev = inode->i_private;
FAR struct can_reader_s *reader = filep->f_priv;
...
flags = enter_critical_section();
/* Handle built-in ioctl commands */
switch (cmd)
{
...
/* Not a "built-in" ioctl command.. perhaps it is unique to this
* lower-half, device driver. */
default:
{
ret = dev_ioctl(dev, cmd, arg);
}
break;
}
leave_critical_section(flags);
return ret;
}
```
There are a few instances where the user can trigger a kernel crash, caused by a division by zero on `CANIOC_SET_BITTIMING` command. On STM32 platforms (arch/arm/src/stm32/stm32_fdcan.c), while there is a `DEBUGASSERT` assertion for `bt->bt_baud`, the check does not cover value `0`.
```c
static const struct can_ops_s g_fdcanops =
{
...
.co_ioctl = fdcan_ioctl,
...
};
static int fdcan_ioctl(struct can_dev_s *dev, int cmd, unsigned long arg)
{
...
switch (cmd)
{
...
case CANIOC_SET_BITTIMING:
{
const struct canioc_bittiming_s *bt = (const struct canioc_bittiming_s *)arg;
uint32_t nbrp;
uint32_t ntseg1;
uint32_t ntseg2;
uint32_t nsjw;
uint32_t ie;
uint8_t state;
DEBUGASSERT(bt != NULL);
DEBUGASSERT(bt->bt_baud < STM32_FDCANCLK_FREQUENCY); // <- not valid
DEBUGASSERT(bt->bt_sjw > 0 && bt->bt_sjw <= 16);
DEBUGASSERT(bt->bt_tseg1 > 1 && bt->bt_tseg1 <= 64);
DEBUGASSERT(bt->bt_tseg2 > 0 && bt->bt_tseg2 <= 16);
/* Extract bit timing data */
ntseg1 = bt->bt_tseg1 - 1;
ntseg2 = bt->bt_tseg2 - 1;
nsjw = bt->bt_sjw - 1;
nbrp = (uint32_t)
( ((float) STM32_FDCANCLK_FREQUENCY /
((float)(ntseg1 + ntseg2 + 3) * (float)bt->bt_baud)) - 1 ); // <- div by 0
```
Similarly, another division by zero was found in Artery Technology AT32 (arch/arm/src/stm32/stm32_can.c) driver:
```c
static const struct can_ops_s g_canops =
{
...
.co_ioctl = at32can_ioctl,
...
};
static int at32can_ioctl(struct can_dev_s *dev, int cmd, unsigned long arg)
{
...
/* Handle the command */
switch (cmd)
{
...
case CANIOC_SET_BITTIMING:
{
const struct canioc_bittiming_s *bt = (const struct canioc_bittiming_s *)arg;
...
uint32_t tmp;
uint32_t regval;
DEBUGASSERT(bt != NULL);
DEBUGASSERT(bt->bt_baud < AT32_PCLK1_FREQUENCY); // <- not valid
DEBUGASSERT(bt->bt_sjw > 0 && bt->bt_sjw <= 4);
DEBUGASSERT(bt->bt_tseg1 > 0 && bt->bt_tseg1 <= 16);
DEBUGASSERT(bt->bt_tseg2 > 0 && bt->bt_tseg2 <= 8);
regval = at32can_getreg(priv, AT32_CAN_BTMG_OFFSET);
/* Extract bit timing data tmp is in clocks per bit time */
tmp = AT32_PCLK1_FREQUENCY / bt->bt_baud; // <- div by 0
```
Instances found are listed in the *Location* section below. They are not shown in detail to reduce the length of the issue.
Ensure the attacker-controlled data is properly validated before use, to stop division by zero situations. For instance:
```c
DEBUGASSERT(bt->bt_baud > 0 && bt->bt_baud < AT32_PCLK1_FREQUENCY);
```
* arch/arm/src/stm32/stm32_fdcan.c
* arch/arm/src/stm32/stm32_can.c
* arch/arm/src/sama5/sam_mcan.c
* arch/arm/src/at32/at32_can.c
* arch/arm/src/samv7/sam_mcan.c
* arch/arm/src/stm32f0l0g0/stm32_fdcan.c
* arch/arm/src/stm32f7/stm32_can.c
* arch/arm/src/stm32h5/stm32_fdcan.c
* arch/arm/src/stm32l4/stm32l4_can.c
* arch/arm/src/tiva/common/tiva_can.c
* drivers/can/mcp2515.c
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
On ARMv7-M/ARMv8-M, the hardware exception return determines the final
SP from the physical location of the HW exception frame, ignoring any
software modification to REG_R13 in the saved register context. This
means signal handlers that adjust SP have their change silently
discarded.
Fix this by relocating the saved context in arm_sigdeliver before
calling arm_fullcontextrestore. If the desired SP (regs[REG_R13])
differs from the implied SP, memmove the entire context frame so that
the hardware exception return produces the correct final SP.
The fix runs only in the signal return path, adding zero overhead to the
normal exception return hot path.
Signed-off-by: Andrew Au <cshung@gmail.com>
When the buffer to send has a size not multiple of 4 bytes, 4-byte words
are sent correctly, but when the code reaches the section to send the
remaining bytes (1, 2 or 3) it was taking the remaining byte count as origin
of the copy, instead of the buffer (as it should). This commit fixes it
to correctly copy from the buffer pointer.
Signed-off-by: Carlos Sanchez <carlossanchez@geotab.com>
Currently stm32l0538-disco is using all its space on NuttX mainline
After some investigation I noticed that DD is using more than 1500
bytes. After disabling it the board returned to compile.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Align the NuttX open(2) flag constants with the Linux asm-generic
values so that the FUSE wire protocol and other cross-platform
interfaces work without conversion.
All code that used '(flags & O_RDONLY)' as a bitmask check (always 0
now that O_RDONLY=0) has been updated to use '(flags & O_ACCMODE)'
comparisons.
The NUTTX_O_* constants in include/nuttx/fs/hostfs.h are updated to
match, and the sim hostfs open flag mapping is fixed.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
O_RDOK and O_WROK are non-standard aliases for O_RDONLY and O_WRONLY
respectively. Having two names for the same flag creates confusion,
especially when aligning the flag values with Linux. Remove the
aliases and replace all uses with the standard O_RDONLY/O_WRONLY.
No functional change — O_RDOK was defined as O_RDONLY and O_WROK as
O_WRONLY, so the replacement is a pure text substitution.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Add fs_checkmode() and fs_checkopenperm() for reuse across filesystems.
Enforce pseudoFS mode bits in inode_checkperm() and allow world-readable
open of passwd/group entries so getpwnam() works after seteuid().
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Add pseudoFS permission enforcement for unlink(), mkdir(), and rename() VFS mutation operations.
This change validates parent-directory permissions before modifying pseudoFS inode topology and returns -EACCES for unauthorized operations.
The implementation preserves mountpoint filesystem behavior and fixes multiple inode lifetime/search-state issues in the rename path.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
An attacker can specify an arbitrary page address when reading MIFARE tags.
Without validation, this could read beyond intended memory regions on the
tag, potentially causing a crash.
The mfrc522_mifare_read() command is also not robust and does not check
that the page address is valid. From section 7.6.5 of the *MIFARE Ultralight
contactless single-ticket IC
(https://www.nxp.com/docs/en/data-sheet/MF0ICU1.pdf) document:
>> The READ command needs the page address as a parameter. Only addresses
00h to 0Fh are decoded.
Testing: Builds fine.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
This reuses implementation of trunc in case long double has same size as
double.
The previous implementation is used only in case x87 80-bit float point
is the long double. In other cases the logic is intentionally replaced
with panic to not provide a wrong result.
Signed-off-by: Karel Kočí <kkoci@elektroline.cz>
NuttX defines constants for the sizes of types just as constants
directly in the code. The real values depend on compiler and target
platform. It is possible that value declared by NuttX header is wrong
compared to the compiler configuration. This is more likely in case of
floating points.
Not all compilers supported by NuttX provide required info through
defines and thus it is more generic to specify limits as constants, but
in case compiler provides them then it is a good idea to compare. This
commit adds such set of comparisons for limits.h and float.h constants.
The comparisons were tested with GCC and Clang. They will be ignored in
case compiler doesn't provide them.
Signed-off-by: Karel Kočí <kkoci@elektroline.cz>
This addresses "FIX ME" definitions for the long double. These might not
be all long double format supported by NuttX.
The support was also added only for GCC alike compilers. Other compilers
that have CONFIG_HAVE_LONG_DOUBLE defined will fail with error that
mantisage digits have to be defined for that compiler.
Signed-off-by: Karel Kočí <kkoci@elektroline.cz>
