CV-Bowen opened a new pull request, #21332:
URL: https://github.com/apache/nuttx/pull/21332
## Summary
On a duplicate START and on a length or CRC mismatch, the port uart rx
worker dumps the frame header with `rpmsgerrdump("Recv hdr:", hdr,
hdr->len)`. `hdr->len` was parsed from the incoming bytes, so on exactly
these error paths it can be anything up to 65535 and the dump reads past
the rx queue slot (AddressSanitizer: heap-buffer-overflow in
`lib_dumpbuffer()`).
Dump `next` bytes instead. That is what was actually copied into the
slot, and the copy loop only advances it while `next < rxq->len`.
## Impact
The error dump is limited to the received bytes. No API or Kconfig
change.
## Testing
Host: Ubuntu 22.04.5 LTS x86_64, QEMU version 10.2.1, sim: cc (Ubuntu
13.1.0-8ubuntu1~22.04) 13.1.0, qemu-armv8a: aarch64-none-elf-gcc (Arm GNU
Toolchain 12.2.Rel1 (Build arm-12.24)) 12.2.1 20221205
The changed lines only run when a frame fails validation, which does
not happen on the in-tree links. The qemu-armv8a server/proxy
configurations still run the port uart driver over /dev/ttyV0, so the
baseline below checks the normal rx path is unaffected:
Baseline (`test.sh`, cases: baseline.yaml):
- host: Ubuntu 22.04.5 LTS x86_64, QEMU version 10.2.1, sim: cc (Ubuntu
13.1.0-8ubuntu1~22.04) 13.1.0, qemu-armv8a: aarch64-none-elf-gcc (Arm GNU
Toolchain 12.2.Rel1 (Build arm-12.24)) 12.2.1 20221205
- tested: nuttx cc902f9ba05 apps 15a6f29e2
- qemu-armv8a built with test-only overlay: disabled LIBC_ENVPATH
BINFMT_CHECKEXEC
- sim:rpserver + sim:rpproxy: PASS
- [x] `uname -a` (server)
- [x] `rpmsg dump all` (server)
- [x] `rpmsg ping all 10 1024 3 0` (server)
- [x] `uname -a` (proxy)
- [x] `rpmsg ping all 10 1024 3 0` (proxy)
- [x] `mount -t rpmsgfs -o cpu=server,fs=/proc /sp` (proxy)
- [x] `cat /sp/version` (proxy)
- [x] `rpmsg dump all` (proxy)
- qemu-armv8a:rpserver + qemu-armv8a:rpproxy: PASS
- [x] `uname -a` (server)
- [x] `uname -a` (proxy)
- [x] `rpmsg dump all` (server)
- [x] `rpmsg ping all 10 1024 3 0` (server)
- [x] `rpmsg ping all 10 1024 3 0` (proxy)
- [x] `mount -t rpmsgfs -o cpu=server,fs=/proc /sp` (proxy)
- [x] `cat /sp/version` (proxy)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
