On a cache miss arp_find() returns the MAC of any interface holding the
address, ignoring the egress device. Two interfaces on one subnet then
leave the peer unreachable until the entry is relearned.
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
The -EINPROGRESS path jumps over the netdev_unlock() below it, so the
caller waits holding d_lock. The receive path needs that same lock to
dispatch the ARP reply, and the interface stalls for good.
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
esp_reconnect_work_cb() dereferences g_sta_reconnect, which is only
declared under ESP_WLAN_HAS_STA, so CONFIG_ESPRESSIF_WIFI_SOFTAP alone
fails to compile. Guard the callback as the Xtensa counterpart does.
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
The Depends-On feature (commit e73f7f7d0e) made the Build workflow
trigger on PR description edits. A gate job checks whether the edit
changed any Depends-On declaration: if yes, the build jobs run again
with the new dependencies; on any other edit the gate skips all build
jobs.
The gate has a side effect that breaks PR check results. Skipped jobs
still register check results on the PR, and the PR checks view shows
the newest check run of each name. So after any description edit the
PR shows "skipped" for every build check instead of the pass/fail
from the real run. Re-running that newest run only repeats the skip,
so the real results never come back. This can also hide a red X from
a failed build.
Fix by not triggering Build on description edits at all: remove the
"edited" event type and the gate job.
Depends-On keeps working: dependencies are read from the description
at the start of every run against master, as before. Fetch-Source now
re-reads the description through the API instead of using the copy
stored in the event payload, so every run uses the current Depends-On
state no matter how it was triggered.
After editing a Depends-On line, retrigger CI by any of:
- pushing new or rebased commits to the PR branch
- closing and reopening the PR
- pressing "Re-run all jobs" on the existing Build run
A description edit alone no longer triggers anything, which is
exactly the behavior that corrupted the PR check results.
Update Documentation/testing/nuttx-ci.rst accordingly.
Same change as in nuttx-apps; both repos received the gate from the
same Depends-On feature.
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
For kernel builds where CONFIG_ARCH_TEXT_VBASE is set to 0, allow a NULL
buffer in file_readv() to prevent ELF binary loading failures for
binaries located at address 0.
This fix was originally introduced in #18830, but was inadvertently
reverted by someone unaware that platforms with CONFIG_ARCH_TEXT_VBASE
equal to 0 cannot function at all without it. This commit restores the
necessary check to prevent regressions in zero-based text kernel
configurations. Most platforms remain completely unaffected since only
about 5 boards utilize a text virtual base of zero.
Signed-off-by: Lwazi Dube <lwazeh@gmail.com>
The clock framework has no debug output of its own, so a provider
reporting a clock it could not register, or a tree it wants to dump at
startup, has to reach for the bare _err() and _info() macros. Those are
gated only by DEBUG_ERROR and DEBUG_INFO, so the output cannot be turned
off without silencing every subsystem that has not been given its own
level.
Add CONFIG_DEBUG_CLK with the usual three levels and the matching
clkerr(), clkwarn() and clkinfo() macros, alongside the pinctrl ones in
the previous commit and for the same reason.
Nothing selects these, so the build is unchanged until a provider starts
using them.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Justin Hammond <justin@dynam.ac>
The pinctrl framework has no debug output of its own, so a provider
reporting a pad it could not configure has to reach for the bare _err()
and _info() macros. Those are gated only by DEBUG_ERROR and DEBUG_INFO,
so the output cannot be turned off without silencing every subsystem that
has not been given its own level.
Add CONFIG_DEBUG_PINCTRL with the usual three levels and the matching
pinctrlerr(), pinctrlwarn() and pinctrlinfo() macros, in the same shape as
the reset ones above them.
Nothing selects these, so the build is unchanged until a provider starts
using them.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Justin Hammond <justin@dynam.ac>
STM32H5 stores the UID in flash memory that supports only 16-bit or
32-bit read accesses. The 8-bit reads introduced with the stm32_uid
unification generate an AHB bus error and hard fault the chip when
the Ethernet driver reads the MAC address.
Read the UID as three 32-bit words into an aligned buffer and copy it
to the caller's buffer. On little-endian ARM the resulting byte order
is identical to byte reads, so behavior is unchanged for the other
STM32 families.
Fixes: https://github.com/apache/nuttx/issues/19771
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
x86 selected neither fork primitive, so vfork() was not available on this
architecture at all.
fork.S takes the register snapshot and hands it to x86_fork(), which allocates
the child, copies the used part of the caller's stack, and starts it. There is
one entry point for both primitives, because the snapshot is the same for
either.
Unlike the register-passing architectures, cdecl puts the flag on the stack, so
up_fork() loads it from 4(%esp). That slot is also the stack pointer the
caller had: it pushed the argument, then `call' pushed the return address. So
the low end of the region that x86_fork() copies is unchanged.
POSIX fork() is not provided. It needs an address environment that can be
duplicated and this architecture has none, so CONFIG_ARCH_HAVE_FORK is never
set here. x86_fork.c makes that a build error rather than a silent omission.
Verified under QEMU with qemu-i486:nsh. ostest runs to the end and reports
"Child 5 ran and exited before the parent resumed", with fork() correctly
absent.
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
hci_acl() looked up the connection with bt_conn_lookup_handle(), which
returns a new reference, but never released it. This leaked one conn
reference for every received ACL packet.
bt_conn_receive() also consumes the buffer on every path: it forwards
to l2cap (which releases) or stores the buffer in conn->rx without an
addref. The hci_rx_work() worker then called bt_buf_release() on the
same buffer, which caused a double free or use-after-free.
Take an extra buffer reference for the worker to release, and release
the connection reference from the lookup.
Assisted-by: Fable
Signed-off-by: AbhinavMir <atg271@gmail.com>
Wire the shared Ameba SPI (DesignWare SSI) driver
(arch/arm/src/common/ameba/ameba_spi.c) into the RTL8721F (amebagreen2)
build and expose the SPI0/SPI1 masters at /dev/spiN.
Add the per-chip ameba_spi_chip.h with the amebagreen2 controller bases
(0x40121000 / 0x40122000, non-secure aliases), the group-0 SPI clock masks
(bit14/bit15), and the per-signal crossbar pad-mux codes (SPI0 75/76/77/78,
SPI1 79/80/81/82). The SSI ip_clk is the PERI_HCLK-domain clock, which the
amebagreen2 fwlib exposes directly through HPERI_ClkGet(), so AMEBA_SPI_IPCLK()
is a single ROM call rather than the register poking the other ICs need.
Compile the common driver and the SDK fwlib SSI RAM source under
CONFIG_AMEBA_SPI, register the bus in the board bring-up, and add an "spi"
board configuration exercising the system/spi spitool.
Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
Wire the shared Ameba SPI (DesignWare SSI) driver
(arch/arm/src/common/ameba/ameba_spi.c) into the RTL8720F build and expose
the SPI0/SPI1 masters at /dev/spiN.
Add the per-chip ameba_spi_chip.h with the RTL8720F controller bases
(0x401C1000 / 0x401C2000, non-secure aliases), the group-0 SPI clock masks,
the per-signal crossbar pad-mux codes (RTL8720F has no generic
PINMUX_FUNCTION_SPI), and the SYS_PLL-based ip_clk computation
(REG_LSYS_CKD_SYS_PLL_GRP0 HPERI divider). The chip header declares the
SYS_PLL_ClkGet() query its AMEBA_SPI_IPCLK() uses, since RTL8720F has no
PLL_ClkGet().
Compile the common driver and the SDK fwlib SSI RAM source under
CONFIG_AMEBA_SPI, register the bus in the board bring-up, and add an "spi"
board configuration exercising the system/spi spitool.
Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
Add a shared NuttX SPI master lower-half for the Realtek Ameba SPI
controllers (SPI0/SPI1) in arch/arm/src/common/ameba, driven through the
SDK fwlib in polling mode with full-duplex exchange and a software chip
select. Per-chip wiring (controller count, register bases, clock masks,
crossbar pad-mux codes and the fwlib SSI_InitTypeDef layout) lives in
arch/arm/src/rtl8721dx/ameba_spi_chip.h so a port to the other Ameba
chips only supplies a same-named header.
Each controller registers as /dev/spiN from pke8721daf bring-up through
the stock SPI character driver; a dedicated `spi` defconfig drives the
spitool for validation.
Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
Add documentation for the stty terminal configuration utility,
describing usage, available settings, examples, and configuration
options.
Signed-off-by: fangpeina <fangpeina@xiaomi.com>
* According to strdup(3) manual strdup() allocates memory with malloc(3)
and that memory should be released with free(3) when no longer needed.
* For non existent path or file open error mkversion used exit() with no
prior free() for allocated memory.
* This change introduces ret variable, exit label, and free on exit in order
to avoid potential memory leak.
* tools/mkversion is a tiny short-lived utility and the memory gets freed
by the OS upon application termination so that was not a bit issue, but now
memory leak scanners should be happy as we have free() in pair to strdup().
Reported-by: xjDeng.
Signed-off-by: Tomasz 'CeDeROM' CEDRO <tomek@cedro.info>
tzset() is unconditionally defined in libs/libc/time/lib_localtime.c,
but its prototype in <time.h> is gated behind CONFIG_LIBC_LOCALTIME --
without it, Toybox's own tzset() calls (lib/xwrap.c, toys/posix/date.c)
compile as implicit declarations instead. The stm32f4discovery:toybox
defconfig already carries this option (see its own commit message);
sim:toybox's was simply missing it.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Assisted-by: Claude Sonnet 5 <noreply@anthropic.com>
Basic usage/configuration reference for the toybox application, plus
known limitations: ps lists no processes (it expects Linux's
/proc/<pid>/stat, which NuttX's procfs doesn't provide), and grep -r
is unreliable against procfs.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Assisted-by: Claude Sonnet 5 <noreply@anthropic.com>
Same shape as boards/sim/sim/sim/configs/toybox: CONFIG_SYSTEM_TOYBOX=y
with CONFIG_INIT_ENTRYPOINT="toybox_main", built on top of the existing
stm32f4discovery:nsh defconfig's board/console setup.
Needs several options nsh's defconfig doesn't, since Toybox's library
code references more of NuttX's libc unconditionally than NSH does:
CONFIG_ALLOW_MIT_COMPONENTS (gates CONFIG_LIBC_REGEX -- grep/sed/etc),
CONFIG_ARCH_SETJMP_H (sigjmp_buf; the REPL's rebound trap uses
sigsetjmp/siglongjmp), CONFIG_LIBC_EXECFUNCS, CONFIG_LIBC_LOCALE,
CONFIG_LIBC_LOCALTIME, CONFIG_PIPES, CONFIG_PSEUDOFS_SOFTLINKS,
CONFIG_FS_NOTIFY (tail -f), CONFIG_SCHED_HAVE_PARENT (waitpid()).
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Assisted-by: Claude Sonnet 5 <noreply@anthropic.com>
CONFIG_SYSTEM_TOYBOX=y with CONFIG_INIT_ENTRYPOINT="toybox_main":
Toybox as the system's shell instead of NSH. No NSH config is present
-- Toybox has no dependency on it in either direction (see
apps/system/toybox/Kconfig's SYSTEM_TOYBOX_BUILTIN_BRIDGE).
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Assisted-by: Claude Sonnet 5 <noreply@anthropic.com>
inode_nextname() already skipped a '.' segment mid-path (e.g. "./foo"),
but only checked for a '/' right after it -- a path ending in a bare
'.' (e.g. "/foo/.", or "." itself once AT_FDCWD resolution prepends
$PWD) fell through and was looked up as a literal child named ".",
which no real node is ever named, failing with ENOENT.
This broke every "operate on the current directory" idiom relative
paths rely on: bare `ls`, `stat .`, `cd .`, etc., all failed outright
even though the equivalent absolute path worked fine. Found while
testing the Toybox port's interactive REPL, but this is generic VFS
path resolution, not Toybox-specific.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Assisted-by: Claude Sonnet 5 <noreply@anthropic.com>
wait4() is BSD/Linux-standard (used by toybox's "time" applet) but NuttX
only had waitpid()+getrusage() separately. Add it to libs/libc/unistd/
built on top of those two existing primitives, so it needs no syscall
plumbing of its own and works unmodified across flat/protected/kernel
build separation. Prototype added to include/sys/wait.h.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Assisted-by: Claude Sonnet 5 <noreply@anthropic.com>
padlen = sizeof(void *) - (addr % sizeof(void *)) never returns 0, even
when addr is already pointer-aligned -- it returns a full alignment unit
instead. Since callers size buflen for zero padding, the subsequent
"buflen < padlen + reqdlen" check then always fails, so getgrgid()/
getgrnam() and their _r variants always return ERANGE.
Found via `id` on sim:toybox, which resolves gid 0 to "root" through
this path.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Assisted-by: Claude Sonnet 5 <noreply@anthropic.com>
In a protected build the kernel must stay in the flash half that
memory.ld gives it. ARCHSCRIPT selected ld.script, which declares the
whole 256 KiB of flash as one region, so nothing held the kernel to its
half. The kernel image grew past the boundary unseen: its .data
initialiser ran 1384 bytes into 0x00020000, where the user image is
programmed.
Select memory.ld and kernel-space.ld when CONFIG_BUILD_PROTECTED is set.
The link now fails when the kernel does not fit.
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
The protected build gives the kernel the first 128 KiB of flash and the
user image the second. Both halves were full. The kernel image was
132456 bytes and the user image 130668, which is 1308 bytes more than
the 256 KiB the LM3S6965 has. The two images overlapped.
Remove from the configuration what QEMU cannot use, and what other
configurations of this board already cover: MMC/SD over SPI with SSI0,
because the QEMU model has no SSI; semihosting hostfs; the GPIO
interrupt ports, which no driver in this configuration uses; and the
wget example with its web client.
The kernel image is now 124580 bytes and the user image 125500. Each
half has more than 5 KiB free.
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
The nRF5340 DK uses the HFXO internal load capacitors at 7 pF.
Provide the board value so nrf53_oscconfig() programs XOSC32MCAPS
instead of leaving the radio crystal untrimmed.
Signed-off-by: raiden00pl <raiden00@railab.me>
drivers/lcd/Kconfig offers CONFIG_LCD_APA102_XRES, CONFIG_LCD_APA102_YRES and
CONFIG_LCD_APA102_FREQUENCY under "if LCD_APA102", but apa102_lcd.c tests for
CONFIG_APA102_XRES, CONFIG_APA102_YRES and CONFIG_APA102_FREQUENCY, which no
Kconfig file defines. The #ifndef fallbacks therefore always win and the
matrix geometry is hard-wired to 16x16 no matter what is configured. The
frequency setting is doubly dead: even the fallback is unused, because
apa102_configspi() calls SPI_SETFREQUENCY() with APA102_SPI_MAXFREQUENCY from
include/nuttx/leds/apa102.h, which is 100 kHz (its "Default 4MHz" comment
notwithstanding), so the chain is always clocked at 100 kHz.
Use the names the Kconfig actually defines and drive the bus at the
configured frequency. The fallback definitions are kept for an
out-of-Kconfig build and given the Kconfig defaults; 16x16 keeps the previous
geometry for anyone who never set the options.
Verified on stm32f4discovery:nsh with CONFIG_LCD_APA102_XRES=8,
CONFIG_LCD_APA102_YRES=4 and CONFIG_LCD_APA102_FREQUENCY=4000000: the shadow
framebuffer in g_apa102dev shrinks to 8x4 LEDs and the SPI frequency
argument is 0x003d0900, where before the settings had no effect at all.
Signed-off-by: Ricard Rosson <ricard@groundbits.com>
Assisted-by: Claude Opus 5 (Claude Code)
drivers/ is built by a single flat Makefile: every per-directory Make.defs
appends its sources to one CSRCS list and its directory to one VPATH, and the
objects all land in drivers/ named after the source basename. Two sources
with the same basename in different subdirectories therefore map to the same
object, and make resolves the prerequisite through VPATH, which is searched
in the order drivers/Makefile includes the Make.defs files. lcd is included
before leds, so drivers/lcd always wins.
Both apa102 and max7219 exist twice, once as an LCD front-end and once as an
LED driver:
drivers/lcd/apa102.c CONFIG_LCD_APA102 drivers/leds/apa102.c CONFIG_LEDS_APA102
drivers/lcd/max7219.c CONFIG_LCD_MAX7219 drivers/leds/max7219.c CONFIG_LEDS_MAX7219
drivers/lcd/Make.defs puts lcd on the VPATH for the whole directory whenever
CONFIG_LCD=y, so selecting only the LED driver still builds apa102.o from
drivers/lcd/apa102.c and the selected LED driver is never compiled at all.
Because the LCD front-ends take their constants from
include/nuttx/lcd/apa102.h and include/nuttx/lcd/max7219.h, which are behind
CONFIG_LCD_APA102 / CONFIG_LCD_MAX7219, the substituted source does not even
compile. With CONFIG_LCD=y + CONFIG_LEDS_APA102=y and CONFIG_LCD_APA102
unset:
lcd/apa102.c:701:20: error: 'APA102_BLACK' undeclared (first use in this
function); did you mean 'APA102_BPP'?
and correspondingly for CONFIG_LEDS_MAX7219 without CONFIG_LCD_MAX7219:
lcd/max7219.c:773:20: error: 'MAX7219_BLACK' undeclared (first use in this
function); did you mean 'MAX7219_BPP'?
So neither LED driver can be built together with CONFIG_LCD, and there is no
diagnostic pointing at the real cause.
Give the LCD front-ends distinct basenames. The LCD side is the adapted use
of these parts (an LED matrix driven as a display), and drivers/lcd already
names such variants for their role, e.g. ht16k33_14seg.c, so the suffix goes
there and the LED drivers keep the plain part names. The CMake build derives
object paths from the source directory and was never affected; its source
lists are updated to match.
Signed-off-by: Ricard Rosson <ricard@groundbits.com>
Assisted-by: Claude Opus 5 (Claude Code)
Rename abi "x86-softfloat" to just "softfloat" to enable compatibility
with newer rust nightly versions.
Rust recently changed the name of the softfloat abi to one more unified
across targets, and more recently, removed the compat alias.
Signed-off-by: Kay Lambdadelta <lambdadeltakay@proton.me>
Replace the iLLD helpers IfxCpu_resetAndStartCounters() and
IfxCpu_getClockCounter() in the performance-counter path with direct
CSR accesses via tricore_mtcr()/tricore_mfcr().
tricore_reset_ccnt() disables the CPU cycle counter (CPU_CCTRL), clears
CPU_CCNT, then re-enables it; up_perf_gettime() reads CPU_CCNT directly.
This removes the arch/tricore perf path's dependency on the Infineon
iLLD layer. No behavior change.
Signed-off-by: zhangyu117 <zhangyu117@xiaomi.com>
Replace the iLLD register structures (Ifx_CPU_PCON0/1/2, Ifx_CPU_DCON0/1/2)
and the IfxCpu_cfg.h cache-size/line-size macros in the cache path with
direct CSR accesses via tricore_mtcr()/tricore_mfcr() and locally defined
PCON/DCON bit masks. Also switch __isync()/__dsync() to the UP_ISB()/
UP_DSB() barrier wrappers.
This removes the arch/tricore cache path's dependency on the Infineon
iLLD layer. No behavior change.
Signed-off-by: zhangyu117 <zhangyu117@xiaomi.com>
Add tricore_mtcr()/tricore_mfcr() inline-assembly wrappers for the
MTCR/MFCR (move to/from Core Special Function Register) instructions.
These let arch/tricore code access CSRs directly without relying on the
Infineon iLLD intrinsics, and are used by the following iLLD-removal
change in the performance-counter path.
Signed-off-by: zhangyu117 <zhangyu117@xiaomi.com>
The `rx_pin` configuration when `CONFIG_S32K3XX_FLEXCAN2` is defined is
overwritten if `PIN_CAN2_ENABLE` is defined, breaking the flexcan config
for S32K3 MCU.
Signed-off-by: Javier Alonso <javieralonso@geotab.com>
The `rx_pin` configuration when `CONFIG_KINETIS_FLEXCAN2` is defined is
overwritten if `PIN_CAN2_ENABLE` is defined, breaking the flexcan config
for Kinetis MCU. Additionally, the `.enable_high` configuration points to
a non-defined constant/macro (looks like a legacy from the first driver
definition). Based on regularly maintained drivers (such as s32k3), this
was changed to `CAN2_ENABLE_OUT`
Signed-off-by: Javier Alonso <javieralonso@geotab.com>
The `rx_pin` configuration when `CONFIG_S32K1XX_FLEXCAN2` is defined is
overwritten if `PIN_CAN2_ENABLE` is defined, breaking the flexcan config
for S32K1 MCU. Additionally, the `.enable_high` configuration points to
a non-defined constant/macro (looks like a legacy from the first driver
definition). Based on regularly maintained drivers (such as s32k3), this
was changed to `CAN2_ENABLE_OUT`
Signed-off-by: Javier Alonso <javieralonso@geotab.com>
This reverts commit 9b0d46c222.
This change was made to fix a problem in NTFC with kernel build,
but it introduces an incompatibility with make.
We are reverting this change and the NTFC issue will be resolved
on the NTFC side.
Signed-off-by: raiden00pl <raiden00@railab.me>
Document CONFIG_SCHED_NGROUPS, setgroups/getgroups/initgroups, and
setresuid/setresgid in the user identity guide.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Complete the POSIX credential setters for real/effective/saved UID and
GID so login and privilege-drop paths can clear saved-root without
relying on setreuid patterns alone.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Track supplementary GIDs per task group, wire setgroups/getgroups
syscalls when CONFIG_SCHED_NGROUPS > 0, and honor them in DAC checks
via nxsched_has_gid(). When NGROUPS is 0, libc provides getgroups/
setgroups stubs. initgroups() fails instead of silently truncating
when membership exceeds CONFIG_SCHED_NGROUPS.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
cromfs_read()'s fast path decompresses a block directly into the
caller's buffer whenever a read reaches a block at its start and the
caller has room for the whole decompressed block, bypassing the
per-file decompression cache (ff_buffer). It nonetheless marked that
block as cached by setting ff_offset, without ever writing ff_buffer
itself.
A later read of the same block that fell onto the slow path trusted
that false cache tag, skipped decompression, and copied from
ff_buffer without it ever having been populated for that block. A
repeated identical fast-path read of the same block hit the same
false tag and skipped decompression entirely, leaving the caller's
buffer untouched and returning whatever was already there.
Fixed by having the fast path only read the cache, never populate it:
reuse ff_buffer when a prior slow-path read already cached the same
block, otherwise decompress straight into the caller's buffer without
touching ff_offset/ff_buffer.
Co-authored-by: Pavlo
Assisted-by: Claude Code:claude-sonnet-5
Signed-off-by: alexcekay <alexander@auterion.com>
In udp_input()'s broadcast/multicast fan-out loop, each iteration
calls netdev_iob_replace(dev, iob) to swap in a freshly cloned iob
before handing the packet to the next matching connection. That
function unconditionally sets dev->d_len = iob->io_pktlen, which is
the full frame length (IP + UDP headers + payload), undoing the
'dev->d_len -= udpiplen' done once before the loop to strip the
headers off for udp_input_conn().
As a result, every connection after the first sees a d_len that is
udpiplen (IP+UDP header length, eg 28 bytes for IPv4) too large.
This value flows into udp_datahandler() as buflen (it reads
dev->d_len directly) and is stored as the queued packet's declared
length in the connection's read-ahead iob chain. Once more than one
such oversized entry has queued up in the same chain, the consumer
(udp_readahead() in udp_recvfrom.c) parses the following entry's
metadata starting at the wrong offset, so whatever byte happens to
land on src_addr_size is trusted as-is. That single byte (0-255) is
then used as the length in iob_copyout(srcaddr, iob, src_addr_size,
...), which fills a fixed-size stack buffer with no bounds check
outside a DEBUGASSERT - compiled out in release builds - so an
oversized value overflows that stack buffer.
Re-apply the same '-= udpiplen' header-stripping after each
netdev_iob_replace() call in the loop, matching what's already done
once before the loop for the first connection.
Inside udp_input_conn, d_appdata is always set first, and since neither
the ICMP nor ICMPv6 process accesses d_appdata, the redundant d_appdata
settings have been removed.
Signed-off-by: yi chen <94xhn1@gmail.com>
