subsys/bluetooth: Avoid RX overflow in lt_tx_real_no_encode #54119
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
keith-packard
requested review from
carlescufi,
cvinayak,
kruithofa and
thoh-ot
as code owners
60 tasks
Correct, increasing the default in the implementation is not correct. The bug is in the test and needs to be fixed. @erbr-ot could you take a look? |
|
Yeah, there is an issue with the define of PDU_RX_NODE_SIZE in helper_util.c - the use of LL_LENGTH_OCTETS_RX_MAX in PDU_DATA_SIZE is incorrect. I'd like to run this by @thoh-ot, but I think PDU_DATA_SIZE should use sizeof(struct pdu_data) instead. |
|
@cvinayak @erbr-ot @kruithofa Any updates on this? |
keith-packard
force-pushed
the
bt-ll-rx-overflow
branch
from
1e6b56c to
dd682bf
Compare
keith-packard
force-pushed
the
bt-ll-rx-overflow
branch
from
dd682bf to
d04f8b1
Compare
I have no idea what this code does, but when compiling
tests/bluetooth/controller/ctrl_feature_exchange/
bluetooth.controller.ctrl_feature_exchange.test
without -ffreestanding (i.e., with memcpy warnings enabled), I get:
.../tests/bluetooth/controller/common/src/helper_util.c: In function
‘lt_tx_real_no_encode’:
.../tests/bluetooth/controller/common/src/helper_util.c:412:9: error:
‘memcpy’ writing 39 bytes into a region of size 32 overflows the
destination [-Werror=stringop-overflow=]
412 | memcpy((struct pdu_data *)rx->pdu, pdu, sizeof(struct pdu_data));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.../tests/bluetooth/controller/common/src/helper_util.c:410:14: note: at
offset 32 into destination object of size 64 allocated by ‘malloc’
410 | rx = malloc(PDU_RX_NODE_SIZE);
| ^~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
I increased the default size of LL_LENGTH_OCTETS_RX_MAX to satisfy this
warning, but I would be very surprised if this were the correct fix.
Signed-off-by: Keith Packard <[email protected]>
keith-packard
force-pushed
the
bt-ll-rx-overflow
branch
from
d04f8b1 to
f0a0e56
Compare
Ping |
|
See issue #55110 for status |
|
Superseded by #57328 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I have no idea what this code does, but when compiling tests/bluetooth/controller/ctrl_feature_exchange/bluetooth.controller.ctrl_feature_exchange.test without -ffreestanding (i.e., with memcpy warnings enabled), I get:
.../tests/bluetooth/controller/common/src/helper_util.c: In function ‘lt_tx_real_no_encode’: .../tests/bluetooth/controller/common/src/helper_util.c:412:9: error: ‘memcpy’ writing 39 bytes into a region of size 32 overflows the destination [-Werror=stringop-overflow=]
412 | memcpy((struct pdu_data *)rx->pdu, pdu, sizeof(struct pdu_data));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.../tests/bluetooth/controller/common/src/helper_util.c:410:14: note: at offset 32 into destination object of size 64 allocated by ‘malloc’
410 | rx = malloc(PDU_RX_NODE_SIZE);
| ^~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
I increased the default size of LL_LENGTH_OCTETS_RX_MAX to satisfy this warning, but I would be very surprised if this were the correct fix.
Signed-off-by: Keith Packard [email protected]