Currently, the `read` function of the watchdog device is dummy and
does nothing. Although this is fine, it's not useful at all from a
userspace perspective, where you may want to check the current WDOG
status.
A wrapper around the `ioctl` `WDIOC_GETSTATUS` has been added as
the `read` function for the WDOG.
Signed-off-by: Javier Alonso <javieralonso@geotab.com>
Two sequencing problems in the MMC wide bus path break eMMC 4-bit
operation on hosts that program the bus width in the SDIO widebus /
clock callbacks (e.g. STM32H7):
1. The SWITCH command (CMD6) is issued before the host has switched
to wide bus operation. When the card completes the switch while
the host is still in 1-bit mode the switch never takes effect and
every following data transfer times out. Switch the host to wide
bus operation before issuing CMD6.
2. The transfer clock is selected only at the end of mmcsd_widebus(),
so the whole switch sequence runs at ID-mode clock and, on the
affected hosts, the final clock update does not take effect either,
leaving the bus at ~400 kHz. Select the MMC transfer clock before
calling mmcsd_widebus(), and pick CLOCK_MMC_TRANSFER_4BIT when wide
bus operation is active (mirroring the SD card path) so a later
clock selection cannot revert the host to 1-bit.
No behavior change for SD cards, and no change on hosts whose widebus
callback only records the requested state.
Tested on a custom STM32H743 board with eMMC: sd_bench sequential
write ~4.1 MB/s, sequential read ~6.3 MB/s (previously all data
transfers timed out).
Signed-off-by: DuoYuWang <thirteenking.wang@gmail.com>
Both the UART and PTY serial drivers previously assumed all
VT100/ANSI escape sequences were fixed 3-byte CSI sequences, causing
longer CSI and SS3 key sequences (such as Home, End, Delete, and
modified keys) to leak stray characters into the terminal when local
echo was enabled. This patch replaces the fixed-length logic with a
state machine that correctly recognizes and suppresses escape
sequences of any length, while preserving the data delivered to
applications. The change only affects local echo behavior, is fully
backward compatible, and has been validated with both interactive NSH
sessions and automated PTY tests.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Assisted-by: Claude Code
ice40_endwrite() computes how many dummy SPI bytes to clock out after
the bitstream to finish FPGA configuration with:
for (size_t i = 0; i < ICE40_SPI_FINAL_CLK_CYCLES + 7 / 8; i++)
`/` binds tighter than `+` in C, so this parses as
ICE40_SPI_FINAL_CLK_CYCLES + (7 / 8) = 160 + 0 = 160, i.e. the "+ 7 / 8"
is a silent no-op. The macro name and the classic `(n + 7) / 8`
ceiling-division idiom (used elsewhere in embedded code to convert a
bit/cycle count into a byte count) make clear the intent was to send
ceil(ICE40_SPI_FINAL_CLK_CYCLES / 8) = 20 bytes (160 SPI clock cycles,
matching the macro name). Instead the unmodified code sends 160 bytes,
i.e. 1280 clock cycles - 8x more than intended.
Fix by parenthesizing the ceiling-division: (ICE40_SPI_FINAL_CLK_CYCLES
+ 7) / 8, which evaluates to 20, restoring the intended 160-clock-cycle
finalization sequence.
Fixes#19367
Assisted-by: Claude Code:claude-sonnet-5
Signed-off-by: yi chen <94xhn1@gmail.com>
Provide per-instance capture automonitor lookup for watchdog lower halves
that pass callback context, and avoid selecting an unrelated watchdog when
legacy lower halves provide no context. Update STM32 WWDG lower halves to pass
their instance context so multiple watchdog devices remain distinguishable.
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
Assisted-by: OpenAI Codex
blksize_t is currently defined as int16_t, which overflows when a
filesystem reports a block size larger than 32767 bytes. This causes
st_blksize to become zero, leading to an integer divide-by-zero when
st_blocks is calculated in stat().
Widen blksize_t to int32_t to support larger filesystem block sizes.
Update nuttx_blksize_t in include/nuttx/fs/hostfs.h to keep it
consistent with include/sys/types.h.
struct geometry.geo_sectorsize (include/nuttx/fs/ioctl.h) is also
typed blksize_t, so every debug print of that field using a 16-bit
format specifier is updated to PRId32 to match the new width:
drivers/misc/ramdisk.c, drivers/mmcsd/mmcsd_spi.c, drivers/mtd/ftl.c,
fs/driver/fs_blockmerge.c, drivers/mtd/smart.c,
drivers/usbhost/usbhost_storage.c, drivers/mmcsd/mmcsd_sdio.c,
arch/arm/src/s32k1xx/s32k1xx_eeeprom.c,
arch/arm/src/lc823450/lc823450_mmcl.c.
Signed-off-by: Ansh Rai <anshrai331@gmail.com>
Signed-off-by: root <root@LAPTOP-9C7LKDC5.localdomain>
Summary
Permissions (Part 3)
Description:
In kernel builds, any unprivileged process running on the NuttX device can
open /dev/efuse and attempt to read/write fuse content. Reading the fuses
may provide valuable information to an attacker controlling the user process.
The write operation, in extreme cases where the fuse blocks are not locked,
may brick the device.
DISCLAIMER: I tried to be strict with the settings, better to relax them
later if it's needed.
This is part of https://github.com/apache/nuttx/issues/19410
Impact
See https://github.com/apache/nuttx/issues/19410
Testing
Compiles ok.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
Three defects that together prevented macOS from ever mounting a
composite USBMSC function (Linux was mostly unaffected because its
probe sequence and recovery timing never exercised these paths):
1. usbmsc_setup() compared the class-request wIndex against the
compile-time constant USBMSC_INTERFACEID (= CONFIG_USBMSC_IFNOBASE,
i.e. 0) instead of the composite-assigned priv->devinfo.ifnobase.
In composite mode the MSC interface number is nonzero, so
GET MAX LUN, Bulk-Only Mass Storage Reset, and GET/SET INTERFACE
all failed the index check and stalled EP0. Standalone MSC is
unaffected (ifnobase == 0), which is why this went unnoticed.
2. usbmsc_deferredresponse() has its entire body inside
#ifndef CONFIG_USBMSC_COMPOSITE, so the deferred EP0 status stage
for MSRESET/SETINTERFACE was never sent in composite mode and the
host's Bulk-Only reset timed out. (Unreachable before fix 1 --
MSRESET used to stall at the wrong-interface check.) Compile the
body in composite mode too, but suppress the worker's deferred
response for SETCONFIGURATION there: the composite driver answers
that request itself, and a duplicate zero-length packet corrupts
the EP0 state.
3. usbmsc_cmdfinishstate() stalled the bulk IN endpoint whenever a
device-to-host command left a residue, even when the response had
already been sent and terminated by a short packet (or ZLP). The
stall is BOT-legal (USB MSC BOT 6.7.2) but gratuitous: the short
packet already ended the data phase and the residue is reported in
dCSWDataResidue. Hosts such as macOS answer any bulk-IN halt during
device probing with a full Bulk-Only reset sequence, which costs
seconds per command or aborts the probe entirely (macOS probes
MODE SENSE(6) with allocation lengths that exceed the response;
Linux's probe does not). Only halt the endpoint when nothing
terminated the data phase.
Root-cause analysis and host traces in apache/nuttx#19435.
Validated on RP2350 silicon (Raspberry Pi Pico 2 W, composite
CDC-ACM + CDC-NCM + USBMSC): GET MAX LUN answers 1 LUN (previously
EP0 stall and a garbage LUN count on macOS), MSRESET completes 10/10
(previously ETIMEDOUT), MODE SENSE(6) alloc=0xC0 returns short data
plus a CSW with dCSWDataResidue and zero bulk-IN stalls across the
exact-length suite, and macOS now mounts the volume (together with the
companion DCD fixes).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Ricard Rosson <ricard@groundbits.com>
This commit introduces a rudimentary architecture and board port for the
MIPS Creator CI20, featuring the dual core Ingenic JZ4780 SoC (MIPS32).
Included in this initial implementation:
- Basic architectural initialization and startup code for the JZ4780 Core 0.
- Minimal configuration required to execute from RAM.
- Early UART/serial console support for basic debugging and NSH output.
- Minimal board-specific configuration for the CI20 target.
- Console output is routed via UART0 on the expansion header.
This establishes basic support for running NuttX on the MIPS CI20.
Further peripherals, optimization, and extended documentation are left for
future iterations or community contributions.
Build and Runtime Deployment Info:
----------------------------------
The baseline can be configured, compiled using the MIPS MTI toolchain,
and loaded via U-Boot using the following commands (replace
<tftp_dir> with your local TFTP root directory).
./tools/configure.sh -l ci20/nsh
make CROSSDEV=mips-mti-elf-
mkimage -A mips -O linux -T kernel -C none -a 0x80000180 -e 0x800004ac \
-n "nx" -d nuttx.bin <tftp_dir>/nuttx.umg
Note: U-Boot must be properly configured for networking (e.g., valid ipaddr,
serverip, and ethaddr environment variables) to fetch the image over TFTP.
Run this from U-Boot prompt:
tftp nuttx.umg && bootm $fileaddr
Signed-off-by: Lwazi Dube <lwazeh@gmail.com>
Permissions (Part 2)
Description:
In kernel builds, any unprivileged process running on the NuttX
device can open /dev/efuse and attempt to read/write fuse content.
Reading the fuses may provide valuable information to an attacker
controlling the user process. The write operation, in extreme cases
where the fuse blocks are not locked, may brick the device.
DISCLAIMER: I tried to be strict with the settings, better to relax them
later if it's needed.
This is part of https://github.com/apache/nuttx/issues/19410
See https://github.com/apache/nuttx/issues/19410
Compiles ok.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
Fix two latent defects in the W5500 Ethernet driver:
1. NETDEV_RXERRORS() references non-existent variables (line 1351):
In w5500_receive(), the error path uses &priv->dev but the function
parameter is named self and the device field is w_dev. This compiles
only because NETDEV_RXERRORS() expands to nothing without
CONFIG_NETDEV_STATISTICS; enabling statistics breaks the build.
2. d_private set to the device array instead of the instance (line 2069):
In w5500_initialize(), d_private was set to g_w5500 (the global array)
instead of self (the current instance). This is harmless for device 0
(g_w5500 == &g_w5500[0]) but wrong for any devno > 0 — every callback
that recovers the driver state via dev->d_private would operate on
device 0's state.
Fixes#19306
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
Author: hanzhijian <hanzhijian@zepp.com>
Fix security issue where uninitialized kernel stack contents could be
leaked to userspace when mfrc522_picc_select() fails.
In mfrc522_read(), the local variable 'uid' was not initialized before
being passed to mfrc522_picc_select(). If the function fails (e.g., due
to bad data on the SPI bus), the uninitialized uid.sak value could pass
the PICC_TYPE_NOT_COMPLETE check, causing snprintf() to copy
uninitialized kernel stack data to the userspace buffer.
Fixes#19417
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
Author: hanzhijian <hanzhijian@zepp.com>
Description:
In kernel builds, any unprivileged process running on the NuttX device
can open /dev/efuse and attempt to read/write fuse content. Reading the
fuses may provide valuable information to an attacker controlling the user
process. The write operation, in extreme cases where the fuse blocks are
not locked, may brick the device.
This is part of https://github.com/apache/nuttx/issues/19410
Compiles ok.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
fs_getfilep()/fs_putfilep() were renamed to file_get()/file_put().
The PTP clock paths still used the old names, breaking the PTP_CLOCK build.
Signed-off-by: raiden00pl <raiden00@railab.me>
uart_putxmitchar() manipulates dev->xmit.head/buffer directly with
no internal locking - every other caller (uart_write()) takes
dev->xmit.lock first. uart_readv()'s ECHO handling (both the
backspace/delete erase sequence and the normal character echo)
calls uart_putxmitchar() without taking that lock, so a concurrent
uart_write() and a local echo can race on the same circular buffer
state, corrupting it.
Take dev->xmit.lock around each echo's uart_putxmitchar() calls,
matching what uart_write() already does. uart_readv() holds
dev->recv.lock for its own duration, but no other code path ever
acquires recv.lock while holding xmit.lock, so nesting xmit.lock
inside the existing recv.lock scope here doesn't introduce a new
lock-ordering cycle.
Fixes#14845
Signed-off-by: yi chen <94xhn1@gmail.com>
Add lower-half uORB sensor driver for the InvenSense MPU6050 over I2C. Supports accelerometer and gyroscope sensor types, register read/write, fetch, and control operations.
All internal register definitions and full-scale range constants are placed in the private driver C file (drivers/sensors/mpu6050_uorb.c) for clean encapsulation. The device struct uses explicit named members ('accel' and 'gyro') for high readability.
Add Kconfig option CONFIG_SENSORS_MPU6050 under Sensor Drivers, and add build integration to drivers/sensors/Make.defs and CMakeLists.txt.
Signed-off-by: Shriyans S Sahoo <shriyans.s.sahoo@gmail.com>
This commit fixes the incorrect casting of signed types to unsigned
types in the I2S character driver.
NOTE: the I2S character driver IOCTLs retain their original argument
types. This is fine, because errors are reported through errno by the
ioctl call. The returned value in the 'arg' parameter is to be ignored
when the call results in an error. Outside of error codes, all i2s
interfaces return unsigned values.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
EEPROM_DS_COUNT is the number of supported DS2XXX device types and is used as the size of the EEPROM geometry tables. Reject it before storing the device type for later table indexing.
Generated-by: OpenAI Codex
Signed-off-by: aineoae86-sys <ai.neo.ae86@gmail.com>
GS2200M response parsing copies device-provided text fields into fixed-size local buffers.
Add field widths to the sscanf string conversions so the parsed address, port, and command fields stay within their destination arrays.
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
PWMIOC_ENABLE_LED_BANK_MODE uses the provided LED number to index the LP503X led_mode array. Reject values outside the RGB LED range before writing that array.
Generated-by: OpenAI Codex
Signed-off-by: aineoae86-sys <ai.neo.ae86@gmail.com>
When several RNDIS responses are queued, the control request handler sends one complete response if the host wLength is smaller than the whole queue. If the first queued response is also larger than wLength, copying hdr->msglen bytes would overrun the requested transfer and the completion path would consume a partial message.
Return EMSGSIZE before copying in that case so the queued response remains intact for a retry with a large enough wLength.
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
pci_epc_map_msi_irq() used && when checking the EPC pointer and map_msi_irq callback. If epc is NULL, the right-hand side dereferences it; if the callback is NULL on a valid EPC, the guard does not reject it before the call.
Match the surrounding EPC wrappers by rejecting a NULL EPC, an out-of-range function number, or a missing map_msi_irq callback before taking the lock and invoking the operation.
Generated-by: OpenAI Codex
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
pci_epf_device_register() and pci_epf_unregister_driver() used || in DEBUGASSERT expressions that validate a pointer and a required field or callback. If the pointer is NULL, the right-hand side dereferences it; if the pointer is valid but the required member is NULL, the assertion passes.
Require both conditions in each assertion so the debug checks match the preconditions used later in the functions.
Generated-by: OpenAI Codex
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
The existing first-order LCG (seed = 470001 * seed % 999563) has several
quality problems:
- Output range limited to [1, 999562] (~20 bits) instead of full 32-bit
- Lower bits have very short periods (8-bit period = 1, 16-bit = 105)
- Overall period only ~1M, far too short for many applications
- Causes mbedtls_rsa_gen_key to loop forever when rand() consumption
aligns with the cycle length (issue #16760)
Replace the entire order-based LCG implementation (CONFIG_LIBC_RAND_ORDER
0-3) with Marsaglia's xorshift32:
- Full 32-bit output range
- Period 2^32 - 1 (~4.29 billion)
- Fast: just three XOR/shift operations
- No floating-point math needed
- No CONFIG_LIBC_RAND_ORDER configuration required
Remove the CONFIG_LIBC_RAND_ORDER Kconfig option and clean up all
defconfig references (12 boards) and related comments.
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
An attacker can specify an arbitrary page address when reading MIFARE tags.
Without validation, this could read beyond intended memory regions on the
tag, potentially causing a crash.
The mfrc522_mifare_read() command is also not robust and does not check
that the page address is valid. From section 7.6.5 of the *MIFARE Ultralight
contactless single-ticket IC
(https://www.nxp.com/docs/en/data-sheet/MF0ICU1.pdf) document:
>> The READ command needs the page address as a parameter. Only addresses
00h to 0Fh are decoded.
Testing: Builds fine.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
Align the NuttX open(2) flag constants with the Linux asm-generic
values so that the FUSE wire protocol and other cross-platform
interfaces work without conversion.
All code that used '(flags & O_RDONLY)' as a bitmask check (always 0
now that O_RDONLY=0) has been updated to use '(flags & O_ACCMODE)'
comparisons.
The NUTTX_O_* constants in include/nuttx/fs/hostfs.h are updated to
match, and the sim hostfs open flag mapping is fixed.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Driver May Cause a DoS
Invalid data is passed to the NXP Plug & Trust Nano Package used by the
NuttX secure element driver. If the NXP code is not handling the malformed
data, a corruption can occur. Alternatively, if the attacker is able to
point create_signature_args->algorithm in memory at an address that is not
accessible, a crash can occur.
Applicable to:
* `signature_algorithm_mapping[create_signature_args->algorithm]`
* `signature_algorithm_mapping[verify_signature_args->algorithm]`
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
O_RDOK and O_WROK are non-standard aliases for O_RDONLY and O_WRONLY
respectively. Having two names for the same flag creates confusion,
especially when aligning the flag values with Linux. Remove the
aliases and replace all uses with the standard O_RDONLY/O_WRONLY.
No functional change — O_RDOK was defined as O_RDONLY and O_WROK as
O_WRONLY, so the replacement is a pure text substitution.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
The audio tone generator stopped working with the 'echo' command
since https://github.com/apache/nuttx-apps/pull/1559
Before that PR:
nsh> echo "t120o1l16b9n0baan0bn0bn0baaan0b9n0baan0b" > /dev/tone0
tone_write: Received 41 bytes
nsh>
After that PR:
nsh> echo "t120o1l16b9n0baan0bn0bn0baaan0b9n0baan0b" > /dev/tone0
tone_write: Received 40 bytes
tone_write: Received 1 bytes
nsh>
Unfortunately the Audio Tone was not block new write attempts even
when it was already playing a melody.
This commit fix it and avoids the issue caused by that PR.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
To let developers use all procedures implemented in the corresponding
.c file when 1wire_crc.h is included.
Signed-off-by: Jiri Vlasak <jvlasak@elektroline.cz>
PR https://github.com/apache/nuttx/pull/19139 addresses the issue, but there
is one minor problem. In the for loop the element `i+1` is written which
means there can still be an overflow by one element (uint32_t or 4 bytes).
Addressing here with this PR.
Tested locally, builds fine.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
NuttX has no real session/process-group abstraction, so the TTY layer
collapses the foreground process group onto the single dev->pid field
(pgrp == pid, one member per group). Extend the controlling-terminal
support so portable software (e.g. dropbear, socat) that relies on
job-control primitives works without losing the existing NuttX-specific
behaviour.
Driver (serial.c, pty.c):
- TIOCSCTTY now accepts a flag: arg > 0 keeps the historical "target
PID in arg" semantics (NSH registers the foreground command it just
spawned), while arg == 0 selects the calling task via
nxsched_getpid(), matching the POSIX flag convention used by
dropbear/socat/apue. This preserves all existing callers and makes
the previously-dead arg==0 path deliver SIGINT correctly.
- Add TIOCGPGRP/TIOCGSID (return dev->pid) and TIOCSPGRP (set it).
- pty.c gains the same handlers against pd_pid and includes
nuttx/sched.h for nxsched_getpid().
ioctl numbers (tioctl.h): TIOCGPGRP/TIOCSPGRP/TIOCGSID at 0x37-0x39.
libc wrappers:
- termios: tcgetpgrp(), tcsetpgrp(), tcgetsid() over the new ioctls.
- unistd: setsid()/getsid()/setpgid() stubs consistent with the
existing getpgrp()/getpgid() single-session model (sid == pgid ==
pid; setpgid only succeeds for pgid == pid).
Declare the new prototypes in unistd.h (tcgetsid was already in
termios.h) and register all sources in the Make.defs/CMakeLists.
Group-broadcast signalling (kill(-pgrp)) remains unsupported, so
tty signals still target the single dev->pid; a real session/process
group model is left as a follow-up.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
The current implementation exits syslog_write_foreach function
if write to one channel fails, causing other channels not being written
and returning negated errno. libc syslog functions then stay in
an infinite loop, because error is returned and the same bytes
are still passed to syslograwstream_flush and syslog_write_foreach.
The channel write may fail for many reasons - disconnected USB if
CDC ACM syslog is enabled, lost networking if telnet syslog is enabled,
error on NOR flash etc. This shouldn't lead to an ininite loop in the
code though.
The solution ensures all channels in syslog_write_foreach are tried,
therefore the user get the output to the working channels even if
the first one is broken. It also updates syslograwstream_addchar and
syslograwstream_addstring to skip the bytes if all channels fails. This
ensures syslog call won't result in an infinite loop, but the user may
lost the debugging output.
Co-authored-by: Martin Krasula <mkrasula@elektroline.cz>
Signed-off-by: Michal Lenc <michallenc@seznam.cz>
Add QSPI mode to the GD25 MTD driver alongside the existing SPI path.
When CONFIG_GD25_QSPI is selected, sector erase, chip erase, byte read,
page write, and byte write all use the QSPI command/memory interfaces
instead of SPI. Reads use the quad I/O fast-read command (1-4-4) and
writes use the quad page-program command (1-1-4) via QSPIMEM_QUADDATA.
A new Kconfig option enables the QE bit in SR2 at initialisation so the
quad I/O pins are active.
Signed-off-by: Sammy Tran <sammytran@geotab.com>
Update the function definitions in all 6 clk implementation files to
match the uintptr_t parameter type already declared in clk_provider.h.
Fixes CI error:
error: conflicting types for 'clk_register_divider'
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
Change the 'reg' field type from uint32_t to uintptr_t in all clock
provider structs (clk_gate_s, clk_divider_s, clk_phase_s,
clk_fractional_divider_s, clk_multiplier_s, clk_mux_s) and their
corresponding clk_register_*() function prototypes.
Also update clk_write() and clk_read() inline functions to take
uintptr_t parameter and remove the now-redundant (uintptr_t) cast.
On 32-bit embedded platforms uintptr_t equals uint32_t so there is
no functional change. On 64-bit targets (e.g. sim) this fixes
-Wint-to-pointer-cast warnings that GCC15 promotes to errors.
Fixes: #16896
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
The function seek which allows the user to move the cursor to a particular
offset in order to read and write from EEPROM storage does not validate the
offset is valid. Later, this can cause an out-of-bounds reads or writes.
Note that newpos may store a large value, larger than the size of the EEPROM.
Similar change in the SPI driver.
Tested locally, builds fine.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
An unchecked integer assignment in the CAN driver may result in a division-by-zero which would result in a kernel crash (denial of service).
Tested locally, builds fine.
An unchecked integer assignment in the CAN driver may result in a division-by-zero which would result in a kernel crash (denial of service).
The CAN driver `can_ioctl` function, shown below (drivers/can/can.c), receives commands from user processes. Its received arguments `cmd` and content of `arg` are under attacker's control. In the CAN driver, some `ioctl` commands are hardware specific and are processed by calling `dev_ioctl()`. Subsequently, depending on the hardware (STM32 or AT32), this function calls `fdcan_ioctl` or `at32can_ioctl`, as shown in the snippets that follow.
```c
static int can_ioctl(FAR struct file *filep, int cmd, unsigned long arg)
{
FAR struct inode *inode = filep->f_inode;
FAR struct can_dev_s *dev = inode->i_private;
FAR struct can_reader_s *reader = filep->f_priv;
...
flags = enter_critical_section();
/* Handle built-in ioctl commands */
switch (cmd)
{
...
/* Not a "built-in" ioctl command.. perhaps it is unique to this
* lower-half, device driver. */
default:
{
ret = dev_ioctl(dev, cmd, arg);
}
break;
}
leave_critical_section(flags);
return ret;
}
```
There are a few instances where the user can trigger a kernel crash, caused by a division by zero on `CANIOC_SET_BITTIMING` command. On STM32 platforms (arch/arm/src/stm32/stm32_fdcan.c), while there is a `DEBUGASSERT` assertion for `bt->bt_baud`, the check does not cover value `0`.
```c
static const struct can_ops_s g_fdcanops =
{
...
.co_ioctl = fdcan_ioctl,
...
};
static int fdcan_ioctl(struct can_dev_s *dev, int cmd, unsigned long arg)
{
...
switch (cmd)
{
...
case CANIOC_SET_BITTIMING:
{
const struct canioc_bittiming_s *bt = (const struct canioc_bittiming_s *)arg;
uint32_t nbrp;
uint32_t ntseg1;
uint32_t ntseg2;
uint32_t nsjw;
uint32_t ie;
uint8_t state;
DEBUGASSERT(bt != NULL);
DEBUGASSERT(bt->bt_baud < STM32_FDCANCLK_FREQUENCY); // <- not valid
DEBUGASSERT(bt->bt_sjw > 0 && bt->bt_sjw <= 16);
DEBUGASSERT(bt->bt_tseg1 > 1 && bt->bt_tseg1 <= 64);
DEBUGASSERT(bt->bt_tseg2 > 0 && bt->bt_tseg2 <= 16);
/* Extract bit timing data */
ntseg1 = bt->bt_tseg1 - 1;
ntseg2 = bt->bt_tseg2 - 1;
nsjw = bt->bt_sjw - 1;
nbrp = (uint32_t)
( ((float) STM32_FDCANCLK_FREQUENCY /
((float)(ntseg1 + ntseg2 + 3) * (float)bt->bt_baud)) - 1 ); // <- div by 0
```
Similarly, another division by zero was found in Artery Technology AT32 (arch/arm/src/stm32/stm32_can.c) driver:
```c
static const struct can_ops_s g_canops =
{
...
.co_ioctl = at32can_ioctl,
...
};
static int at32can_ioctl(struct can_dev_s *dev, int cmd, unsigned long arg)
{
...
/* Handle the command */
switch (cmd)
{
...
case CANIOC_SET_BITTIMING:
{
const struct canioc_bittiming_s *bt = (const struct canioc_bittiming_s *)arg;
...
uint32_t tmp;
uint32_t regval;
DEBUGASSERT(bt != NULL);
DEBUGASSERT(bt->bt_baud < AT32_PCLK1_FREQUENCY); // <- not valid
DEBUGASSERT(bt->bt_sjw > 0 && bt->bt_sjw <= 4);
DEBUGASSERT(bt->bt_tseg1 > 0 && bt->bt_tseg1 <= 16);
DEBUGASSERT(bt->bt_tseg2 > 0 && bt->bt_tseg2 <= 8);
regval = at32can_getreg(priv, AT32_CAN_BTMG_OFFSET);
/* Extract bit timing data tmp is in clocks per bit time */
tmp = AT32_PCLK1_FREQUENCY / bt->bt_baud; // <- div by 0
```
Instances found are listed in the *Location* section below. They are not shown in detail to reduce the length of the issue.
Ensure the attacker-controlled data is properly validated before use, to stop division by zero situations. For instance:
```c
DEBUGASSERT(bt->bt_baud > 0 && bt->bt_baud < AT32_PCLK1_FREQUENCY);
```
* arch/arm/src/stm32/stm32_fdcan.c
* arch/arm/src/stm32/stm32_can.c
* arch/arm/src/sama5/sam_mcan.c
* arch/arm/src/at32/at32_can.c
* arch/arm/src/samv7/sam_mcan.c
* arch/arm/src/stm32f0l0g0/stm32_fdcan.c
* arch/arm/src/stm32f7/stm32_can.c
* arch/arm/src/stm32h5/stm32_fdcan.c
* arch/arm/src/stm32l4/stm32l4_can.c
* arch/arm/src/tiva/common/tiva_can.c
* drivers/can/mcp2515.c
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
This removes the DEBUGASSERT in ftl_initialize_by_path. Instead, check
compile time that FTL is enabled in case some of the drivers implement
the isbad and markbad functions.
Also select the FTL_BBM for those drivers as they require it.
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
A malformed packet can trigger memory corruption in the kernel leading to a
system crash or potentially arbitrary code execution in the kernel.
The CAN driver for the CTU CAN FD IP Core connected to the NuttX device
via a PCI / PCI Express (PCIe) bus shows a lack of consideration for
malformed data, assuming the CAN frames are always correct.
Ensure `frame->fmt.rwcnt` is 21 or less before it is used in the `for` loop.
A similar change was done in ctucanfd_sock_recv().
Tested locally, builds fine.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
When calling Set RF Configuration command, a compromised user
process can trigger memory corruption in the kernel. This can
lead to a system crash or potentially arbitrary code execution
in the kernel.
It addresses an earlier incomplete fix.
Tested locally.
Signed-off-by: Your Name <catalin_visinescu@yahoo.com>
While attempting to create architecture-specific implementation
of up_udelay, it was discovered that the overriding function is not
included in the final binary, the weak implementation was used instead.
Further investigation and experimentation showed that the linker
only overrides the weak implementation with the custom one if
the custom one is present in a .c source file that contains at least
one other function that is called from somewhere. Some additional
testing revealed that at least one other already present up_udelay
override (rv32m1-vega:nsh) is affected by this.
In a short mailing list discussion it was determined that this
is a likely result of using static libraries during the build process
and it was suggested to introduce configuration option that will
exclude weak implementations of the function from the build altogether.
This patch does that.
This patch does not enable this configuration option for any existing
board/chip because doing so would change its behaviour and needs
to be tested by users of the hardware.
Also changed is the static assertion in sched/clock/clock_delay.c
to not prevent building the code when architecture declares that
it does not use BOARD_LOOPSPERMSEC to determine required loop count.
BOARD_LOOPSPERMSEC is made undefined in such case.
Patch was tested by building breadxavr:nsh (identical binary by SHA256),
rv32m1-vega:nsh (identical text section) and rv-virt:nsh (text section
differs because of different ordering of functions in the binary, ostest
passed though.)
Signed-off-by: Kerogit <kr.git@kerogit.eu>
up_timer_gettime() computed tv_sec and tv_nsec from two separate calls
to current_usec(), which returns a free-running microsecond counter.
The counter advances between the two calls, so a read that straddles a
second boundary yields an inconsistent (possibly backwards) timespec.
Read current_usec() once into a local variable and derive both fields
from that single snapshot.
Signed-off-by: yushuailong <yyyusl@qq.com>
Previously bme680 dont register temperature topic when pressure measurement
was enabled. Temperature data is present in barometer data, but sometimes
we need clear separation between these topics.
The old behavior is still achievable by setting CONFIG_BME680_DISABLE_TEMP_MEAS=y
Signed-off-by: raiden00pl <raiden00@railab.me>
