All I2S driver operation functions say in their signature description
that negative errno values are returned on failure. However, some of
these same functions had `uint32_t` return types. This would result in
incorrect comparison of the return value against signed error code
values.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
pci_epf_device_register() and pci_epf_unregister_driver() used || in DEBUGASSERT expressions that validate a pointer and a required field or callback. If the pointer is NULL, the right-hand side dereferences it; if the pointer is valid but the required member is NULL, the assertion passes.
Require both conditions in each assertion so the debug checks match the preconditions used later in the functions.
Generated-by: OpenAI Codex
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
When several RNDIS responses are queued, the control request handler sends one complete response if the host wLength is smaller than the whole queue. If the first queued response is also larger than wLength, copying hdr->msglen bytes would overrun the requested transfer and the completion path would consume a partial message.
Return EMSGSIZE before copying in that case so the queued response remains intact for a retry with a large enough wLength.
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
pci_epc_map_msi_irq() used && when checking the EPC pointer and map_msi_irq callback. If epc is NULL, the right-hand side dereferences it; if the callback is NULL on a valid EPC, the guard does not reject it before the call.
Match the surrounding EPC wrappers by rejecting a NULL EPC, an out-of-range function number, or a missing map_msi_irq callback before taking the lock and invoking the operation.
Generated-by: OpenAI Codex
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
Check the provided length before reading the current lowoutstream byte. This avoids reading past zero-length or fully consumed buffers before the loop condition stops.
Generated-by: OpenAI Codex
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
EEPROM_DS_COUNT is the number of supported DS2XXX device types and is used as the size of the EEPROM geometry tables. Reject it before storing the device type for later table indexing.
Generated-by: OpenAI Codex
Signed-off-by: aineoae86-sys <ai.neo.ae86@gmail.com>
Limit modem version tokens parsed from AT command responses to the LTE version field sizes. Also require both HWVERSION fields before copying them so a partial parse does not read an uninitialized temporary buffer.
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
The XMC_VADC_* constants describe counts, so the valid register, group, and channel indexes are below those values. The current checks allow the count itself through and then use it to index VADC group, channel, and result registers.
Reject those boundary values before the register array access.
Generated-by: OpenAI Codex
Signed-off-by: aineoae86-sys <ai.neo.ae86@gmail.com>
the timers example causes the following error:
iscv-none-elf-ld: /github/workspace/sources/nuttx/staging/libapps.a(timer_main.c.github.workspace.sources.apps.examples.timer_1.o): in function timer_main:
/github/workspace/sources/apps/examples/timer/timer_main.c:209:(.text.timer_main+0x1c2): undefined reference to sigaction
riscv-none-elf-ld: /github/workspace/sources/apps/examples/timer/timer_main.c:278:(.text.timer_main+0x30e): undefined reference to sigaction
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
If this configuration is enabled it will cause the build error
riscv-none-elf-ld: /github/workspace/sources/nuttx/nuttx section .text will not fit in region ilm
riscv-none-elf-ld: region ilm overflowed by 976 bytes
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
Add more refined options for sched/misc/assert to control how verbose
crash dumps are printed out:
- SCHED_DUMP_TASKS
- SCHED_DUMP_STACK
These default to y unless DEFAULT_SMALL is defined. The options can
be undefined to save flash space on a small system.
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
- Use shared string for "stack pointer out of range" to avoid duplicate in flash
- Re-use already calculated stack_used instead of calling up_check_tcbstack again
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
Replace the per-family stm32_get_uniqueid() implementations and the two
IP-versioned common variants with a single generic byte-array reader,
arch/arm/src/common/stm32/stm32_uid.c.
BREAKING CHANGE for STM32 M0 families: stm32_get_uniqueid() now always
takes a uint8_t[12] buffer.
Out-of-tree Cortex-M0 code that used the previous prototype
"void stm32_get_uniqueid(uint32_t *uid)" must change its buffer to
"uint8_t uniqueid[12]".
Signed-off-by: raiden00pl <raiden00@railab.me>
This commit updates Espressif's common source code to ensure that
critical sections are properly handled by the common source code.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
The fence.i instruction is only available when the Zifencei extension
(CONFIG_ARCH_RV_ISA_ZICSR_ZIFENCEI) is supported by the hardware.
This commit adds a macro wrapper around fence.i usages to prevent
compilation errors on toolchains or targets where the Zifencei
extension is absent.
Signed-off-by: Chengdong Wang <wangcd91@gmail.com>
Includes a defconfig to play NXDoom on the simulator. Keyboard input is
available through X11, as well as graphics rendering. The `/data` folder
is used as the default home for game files.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
Includes documentation about the current state of the DOOM port, where
it came from, how to play and what the requirements are. Includes all of
the warnings about experimental/unfinished features.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
The existing first-order LCG (seed = 470001 * seed % 999563) has several
quality problems:
- Output range limited to [1, 999562] (~20 bits) instead of full 32-bit
- Lower bits have very short periods (8-bit period = 1, 16-bit = 105)
- Overall period only ~1M, far too short for many applications
- Causes mbedtls_rsa_gen_key to loop forever when rand() consumption
aligns with the cycle length (issue #16760)
Replace the entire order-based LCG implementation (CONFIG_LIBC_RAND_ORDER
0-3) with Marsaglia's xorshift32:
- Full 32-bit output range
- Period 2^32 - 1 (~4.29 billion)
- Fast: just three XOR/shift operations
- No floating-point math needed
- No CONFIG_LIBC_RAND_ORDER configuration required
Remove the CONFIG_LIBC_RAND_ORDER Kconfig option and clean up all
defconfig references (12 boards) and related comments.
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
An unchecked integer assignment in the CAN driver may result in a division-by-zero which would result in a kernel crash (denial of service).
Tested locally, builds fine.
An unchecked integer assignment in the CAN driver may result in a division-by-zero which would result in a kernel crash (denial of service).
The CAN driver `can_ioctl` function, shown below (drivers/can/can.c), receives commands from user processes. Its received arguments `cmd` and content of `arg` are under attacker's control. In the CAN driver, some `ioctl` commands are hardware specific and are processed by calling `dev_ioctl()`. Subsequently, depending on the hardware (STM32 or AT32), this function calls `fdcan_ioctl` or `at32can_ioctl`, as shown in the snippets that follow.
```c
static int can_ioctl(FAR struct file *filep, int cmd, unsigned long arg)
{
FAR struct inode *inode = filep->f_inode;
FAR struct can_dev_s *dev = inode->i_private;
FAR struct can_reader_s *reader = filep->f_priv;
...
flags = enter_critical_section();
/* Handle built-in ioctl commands */
switch (cmd)
{
...
/* Not a "built-in" ioctl command.. perhaps it is unique to this
* lower-half, device driver. */
default:
{
ret = dev_ioctl(dev, cmd, arg);
}
break;
}
leave_critical_section(flags);
return ret;
}
```
There are a few instances where the user can trigger a kernel crash, caused by a division by zero on `CANIOC_SET_BITTIMING` command. On STM32 platforms (arch/arm/src/stm32/stm32_fdcan.c), while there is a `DEBUGASSERT` assertion for `bt->bt_baud`, the check does not cover value `0`.
```c
static const struct can_ops_s g_fdcanops =
{
...
.co_ioctl = fdcan_ioctl,
...
};
static int fdcan_ioctl(struct can_dev_s *dev, int cmd, unsigned long arg)
{
...
switch (cmd)
{
...
case CANIOC_SET_BITTIMING:
{
const struct canioc_bittiming_s *bt = (const struct canioc_bittiming_s *)arg;
uint32_t nbrp;
uint32_t ntseg1;
uint32_t ntseg2;
uint32_t nsjw;
uint32_t ie;
uint8_t state;
DEBUGASSERT(bt != NULL);
DEBUGASSERT(bt->bt_baud < STM32_FDCANCLK_FREQUENCY); // <- not valid
DEBUGASSERT(bt->bt_sjw > 0 && bt->bt_sjw <= 16);
DEBUGASSERT(bt->bt_tseg1 > 1 && bt->bt_tseg1 <= 64);
DEBUGASSERT(bt->bt_tseg2 > 0 && bt->bt_tseg2 <= 16);
/* Extract bit timing data */
ntseg1 = bt->bt_tseg1 - 1;
ntseg2 = bt->bt_tseg2 - 1;
nsjw = bt->bt_sjw - 1;
nbrp = (uint32_t)
( ((float) STM32_FDCANCLK_FREQUENCY /
((float)(ntseg1 + ntseg2 + 3) * (float)bt->bt_baud)) - 1 ); // <- div by 0
```
Similarly, another division by zero was found in Artery Technology AT32 (arch/arm/src/stm32/stm32_can.c) driver:
```c
static const struct can_ops_s g_canops =
{
...
.co_ioctl = at32can_ioctl,
...
};
static int at32can_ioctl(struct can_dev_s *dev, int cmd, unsigned long arg)
{
...
/* Handle the command */
switch (cmd)
{
...
case CANIOC_SET_BITTIMING:
{
const struct canioc_bittiming_s *bt = (const struct canioc_bittiming_s *)arg;
...
uint32_t tmp;
uint32_t regval;
DEBUGASSERT(bt != NULL);
DEBUGASSERT(bt->bt_baud < AT32_PCLK1_FREQUENCY); // <- not valid
DEBUGASSERT(bt->bt_sjw > 0 && bt->bt_sjw <= 4);
DEBUGASSERT(bt->bt_tseg1 > 0 && bt->bt_tseg1 <= 16);
DEBUGASSERT(bt->bt_tseg2 > 0 && bt->bt_tseg2 <= 8);
regval = at32can_getreg(priv, AT32_CAN_BTMG_OFFSET);
/* Extract bit timing data tmp is in clocks per bit time */
tmp = AT32_PCLK1_FREQUENCY / bt->bt_baud; // <- div by 0
```
Instances found are listed in the *Location* section below. They are not shown in detail to reduce the length of the issue.
Ensure the attacker-controlled data is properly validated before use, to stop division by zero situations. For instance:
```c
DEBUGASSERT(bt->bt_baud > 0 && bt->bt_baud < AT32_PCLK1_FREQUENCY);
```
* arch/arm/src/stm32/stm32_fdcan.c
* arch/arm/src/stm32/stm32_can.c
* arch/arm/src/sama5/sam_mcan.c
* arch/arm/src/at32/at32_can.c
* arch/arm/src/samv7/sam_mcan.c
* arch/arm/src/stm32f0l0g0/stm32_fdcan.c
* arch/arm/src/stm32f7/stm32_can.c
* arch/arm/src/stm32h5/stm32_fdcan.c
* arch/arm/src/stm32l4/stm32l4_can.c
* arch/arm/src/tiva/common/tiva_can.c
* drivers/can/mcp2515.c
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
On ARMv7-M/ARMv8-M, the hardware exception return determines the final
SP from the physical location of the HW exception frame, ignoring any
software modification to REG_R13 in the saved register context. This
means signal handlers that adjust SP have their change silently
discarded.
Fix this by relocating the saved context in arm_sigdeliver before
calling arm_fullcontextrestore. If the desired SP (regs[REG_R13])
differs from the implied SP, memmove the entire context frame so that
the hardware exception return produces the correct final SP.
The fix runs only in the signal return path, adding zero overhead to the
normal exception return hot path.
Signed-off-by: Andrew Au <cshung@gmail.com>
When the buffer to send has a size not multiple of 4 bytes, 4-byte words
are sent correctly, but when the code reaches the section to send the
remaining bytes (1, 2 or 3) it was taking the remaining byte count as origin
of the copy, instead of the buffer (as it should). This commit fixes it
to correctly copy from the buffer pointer.
Signed-off-by: Carlos Sanchez <carlossanchez@geotab.com>
Currently stm32l0538-disco is using all its space on NuttX mainline
After some investigation I noticed that DD is using more than 1500
bytes. After disabling it the board returned to compile.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Align the NuttX open(2) flag constants with the Linux asm-generic
values so that the FUSE wire protocol and other cross-platform
interfaces work without conversion.
All code that used '(flags & O_RDONLY)' as a bitmask check (always 0
now that O_RDONLY=0) has been updated to use '(flags & O_ACCMODE)'
comparisons.
The NUTTX_O_* constants in include/nuttx/fs/hostfs.h are updated to
match, and the sim hostfs open flag mapping is fixed.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
O_RDOK and O_WROK are non-standard aliases for O_RDONLY and O_WRONLY
respectively. Having two names for the same flag creates confusion,
especially when aligning the flag values with Linux. Remove the
aliases and replace all uses with the standard O_RDONLY/O_WRONLY.
No functional change — O_RDOK was defined as O_RDONLY and O_WROK as
O_WRONLY, so the replacement is a pure text substitution.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Add fs_checkmode() and fs_checkopenperm() for reuse across filesystems.
Enforce pseudoFS mode bits in inode_checkperm() and allow world-readable
open of passwd/group entries so getpwnam() works after seteuid().
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Add pseudoFS permission enforcement for unlink(), mkdir(), and rename() VFS mutation operations.
This change validates parent-directory permissions before modifying pseudoFS inode topology and returns -EACCES for unauthorized operations.
The implementation preserves mountpoint filesystem behavior and fixes multiple inode lifetime/search-state issues in the rename path.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
An attacker can specify an arbitrary page address when reading MIFARE tags.
Without validation, this could read beyond intended memory regions on the
tag, potentially causing a crash.
The mfrc522_mifare_read() command is also not robust and does not check
that the page address is valid. From section 7.6.5 of the *MIFARE Ultralight
contactless single-ticket IC
(https://www.nxp.com/docs/en/data-sheet/MF0ICU1.pdf) document:
>> The READ command needs the page address as a parameter. Only addresses
00h to 0Fh are decoded.
Testing: Builds fine.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
This reuses implementation of trunc in case long double has same size as
double.
The previous implementation is used only in case x87 80-bit float point
is the long double. In other cases the logic is intentionally replaced
with panic to not provide a wrong result.
Signed-off-by: Karel Kočí <kkoci@elektroline.cz>
NuttX defines constants for the sizes of types just as constants
directly in the code. The real values depend on compiler and target
platform. It is possible that value declared by NuttX header is wrong
compared to the compiler configuration. This is more likely in case of
floating points.
Not all compilers supported by NuttX provide required info through
defines and thus it is more generic to specify limits as constants, but
in case compiler provides them then it is a good idea to compare. This
commit adds such set of comparisons for limits.h and float.h constants.
The comparisons were tested with GCC and Clang. They will be ignored in
case compiler doesn't provide them.
Signed-off-by: Karel Kočí <kkoci@elektroline.cz>
This addresses "FIX ME" definitions for the long double. These might not
be all long double format supported by NuttX.
The support was also added only for GCC alike compilers. Other compilers
that have CONFIG_HAVE_LONG_DOUBLE defined will fail with error that
mantisage digits have to be defined for that compiler.
Signed-off-by: Karel Kočí <kkoci@elektroline.cz>
Add QSPI mode to the GD25 MTD driver alongside the existing SPI path.
When CONFIG_GD25_QSPI is selected, sector erase, chip erase, byte read,
page write, and byte write all use the QSPI command/memory interfaces
instead of SPI. Reads use the quad I/O fast-read command (1-4-4) and
writes use the quad page-program command (1-1-4) via QSPIMEM_QUADDATA.
A new Kconfig option enables the QE bit in SR2 at initialisation so the
quad I/O pins are active.
Signed-off-by: Sammy Tran <sammytran@geotab.com>
Add QSPIMEM_QUADDATA to the QSPI memory flags. This flag selects quad
data width while keeping the address phase on a single line (1-1-4),
which QSPIMEM_QUADIO cannot express (it forces quad on both address and
data phases). Update stm32_qspi_memory() to honour the new flag by
setting CCR_DMODE_QUAD without touching the address mode.
Signed-off-by: Sammy Tran <sammytran@geotab.com>
struct gran_s and struct graninfo_s store granule counts in uint16_t.
Reject pools whose computed granule count exceeds UINT16_MAX,
instead of truncating the count and creating an invalid handle.
Signed-off-by: shichunma <shichunma@bestechnic.com>
1. The .kasan.unused and .kasan.global sections contain compiler-generated
data with the WRITE flag (.data..LASAN*), but the linker script placed
them before .text without specifying a memory region. The linker could
not put writable sections into the read-only ROM (rx) region, so it
silently placed them at 0x40000000 in RAM, creating an extra LOAD
segment that conflicts with QEMU virt's RAM layout and causes boot
failure.
2. The .kasan.global should be placed before .data because .data
patten (*(.data*)) includes .kasan.global pattern (*(.data..LASAN0)),
and it cause kasan_global.py cannot find .kasan.global section to
generate the g_global_region array.
3. Move .kasan.shadows from before .text to after .rodata. Placing it
before .text causes .text to shift when .kasan.shadows transitions
from empty (pass 1) to populated (pass 2+), preventing the multi-pass
link addresses from converging. After .rodata it does not affect any
upstream section addresses.
4. Add CMake post-build step to strip .kasan.unused and .kasan.global
sections from the final binary, matching the Makefile build behavior.
Signed-off-by: leisiji <2265215145@qq.com>
When CONFIG_BUILD_KERNEL is enabled, user-space and kernel-space have
separate address spaces. User-space addresses passed via syscalls
(e.g., open) are registered by KASAN but should not be monitored,
as they are not kernel heap allocations. This causes KASAN to
report false positives on user-space pointers accessed through
system calls.
Mark the user-space heap with nokasan=true so KASAN skips checking
its address range, consistent with how rptun already handles this.
Signed-off-by: leisiji <2265215145@qq.com>
When CONFIG_MM_KASAN_GLOBAL is enabled, hook.c is also linked into
libmm.a. However, g_global_region (defined in global.c) is only
injected into the nuttx ELF by kasan_global.py — it does not process
the app binary. This causes undefined symbol errors when linking an
app against libmm.a.
Guard the inclusion of global.c with __KERNEL__ so that only kernel
builds pull in the global KASAN region, while app builds fall back
to the no-op stub.
Signed-off-by: leisiji <2265215145@qq.com>
This file does not build with minor modifications due to nxstyle issues.
Adding symbols to the white_content_list to address_this.
Testing: "gcc -o nxstyle nxstyle.c" builds fine.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
Invalid data is passed to the NXP Plug & Trust Nano Package used by the
NuttX secure element driver. If the NXP code is not handling the malformed
data, a corruption can occur. Alternatively, if the attacker is able to
point create_signature_args->algorithm in memory at an address that is not
accessible, a crash can occur.
Applicable to:
* `signature_algorithm_mapping[create_signature_args->algorithm]`
* `signature_algorithm_mapping[verify_signature_args->algorithm]`
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
Provide correct pin name BOARD_LED1 and associated bit mask
BOARD_LED1_BIT. Also use non-negated `ledon`. Add initialization into
bringup code.
Signed-off-by: Martin Vajnar <martin.vajnar@gmail.com>
