patrick/zephyr
1
0
Fork 0
Code Issues Pull requests Actions 7 Packages Projects Releases Wiki Activity

drivers: ieee802154: don't allocate rx pkt from tx pool

Browse source 
Several IEEE 802154 drivers allocated RX packets from the TX pool.

This may seem like a minor problem at first sight but it may become
problematic if the pool is used to distinguish package types as is the
case in some code paths, e.g. for packet priority or determination of
the packet buffer pool.

This bug also has the potential of starving the TX pool capacity which
even may make devices vulnerable to DoS attacks as sending may be
prohibited by addressing enough RX packets to a device to let it run out
of TX capacity.

Fixes: #51261

Signed-off-by: Florian Grandel <jerico.dev@gmail.com>
This commit is contained in:
Florian Grandel 2022-09-24 13:59:28 +02:00 committed by Carles Cufí
parent 5bc6b157f1
commit 62ed153a86
8 changed files with 20 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/ieee802154/ieee802154_b91.c
View file

@ -206,8 +206,8 @@ static void b91_handle_ack(void)
struct net_pkt *ack_pkt;
/* allocate ack packet */
ack_pkt = net_pkt_alloc_with_buffer(data.iface, B91_ACK_FRAME_LEN,
AF_UNSPEC, 0, K_NO_WAIT);
ack_pkt = net_pkt_rx_alloc_with_buffer(data.iface, B91_ACK_FRAME_LEN,
AF_UNSPEC, 0, K_NO_WAIT);
if (!ack_pkt) {
LOG_ERR("No free packet available.");
return;
@ -301,7 +301,7 @@ static void b91_rf_rx_isr(void)
}
/* get packet pointer from NET stack */
pkt = net_pkt_alloc_with_buffer(data.iface, length, AF_UNSPEC, 0, K_NO_WAIT);
pkt = net_pkt_rx_alloc_with_buffer(data.iface, length, AF_UNSPEC, 0, K_NO_WAIT);
if (!pkt) {
LOG_ERR("No pkt available");
goto exit;

4
drivers/ieee802154/ieee802154_cc1200.c
View file

@ -466,8 +466,8 @@ static void cc1200_rx(void *arg)
goto flush;
}
pkt = net_pkt_alloc_with_buffer(cc1200->iface, pkt_len,
AF_UNSPEC, 0, K_NO_WAIT);
pkt = net_pkt_rx_alloc_with_buffer(cc1200->iface, pkt_len,
AF_UNSPEC, 0, K_NO_WAIT);
if (!pkt) {
LOG_ERR("No free pkt available");
goto flush;

4
drivers/ieee802154/ieee802154_cc2520.c
View file

@ -616,8 +616,8 @@ static void cc2520_rx(void *arg)
goto flush;
}
pkt = net_pkt_alloc_with_buffer(cc2520->iface, pkt_len,
AF_UNSPEC, 0, K_NO_WAIT);
pkt = net_pkt_rx_alloc_with_buffer(cc2520->iface, pkt_len,
AF_UNSPEC, 0, K_NO_WAIT);
if (!pkt) {
LOG_ERR("No pkt available");
goto flush;

4
drivers/ieee802154/ieee802154_dw1000.c
View file

@ -420,8 +420,8 @@ static inline void dwt_irq_handle_rx(const struct device *dev, uint32_t sys_stat
pkt_len -= DWT_FCS_LENGTH;
}
pkt = net_pkt_alloc_with_buffer(ctx->iface, pkt_len,
AF_UNSPEC, 0, K_NO_WAIT);
pkt = net_pkt_rx_alloc_with_buffer(ctx->iface, pkt_len,
AF_UNSPEC, 0, K_NO_WAIT);
if (!pkt) {
LOG_ERR("No buf available");
goto rx_out_enable_rx;

8
drivers/ieee802154/ieee802154_kw41z.c
View file

@ -514,8 +514,8 @@ static inline void kw41z_rx(struct kw41z_context *kw41z, uint8_t len)
pkt_len = len - KW41Z_FCS_LENGTH;
#endif
pkt = net_pkt_alloc_with_buffer(kw41z->iface, pkt_len,
AF_UNSPEC, 0, K_NO_WAIT);
pkt = net_pkt_rx_alloc_with_buffer(kw41z->iface, pkt_len,
AF_UNSPEC, 0, K_NO_WAIT);
if (!pkt) {
LOG_ERR("No buf available");
goto out;
@ -582,8 +582,8 @@ static void handle_ack(struct kw41z_context *kw41z, uint8_t seq_number)
struct net_pkt *ack_pkt;
uint8_t ack_psdu[ACK_FRAME_LEN];
ack_pkt = net_pkt_alloc_with_buffer(kw41z->iface, ACK_FRAME_LEN,
AF_UNSPEC, 0, K_NO_WAIT);
ack_pkt = net_pkt_rx_alloc_with_buffer(kw41z->iface, ACK_FRAME_LEN,
AF_UNSPEC, 0, K_NO_WAIT);
if (!ack_pkt) {
LOG_ERR("No free packet available.");
return;

4
drivers/ieee802154/ieee802154_mcr20a.c
View file

@ -557,8 +557,8 @@ static inline void mcr20a_rx(const struct device *dev, uint8_t len)
pkt_len = len - MCR20A_FCS_LENGTH;
pkt = net_pkt_alloc_with_buffer(mcr20a->iface, pkt_len,
AF_UNSPEC, 0, K_NO_WAIT);
pkt = net_pkt_rx_alloc_with_buffer(mcr20a->iface, pkt_len,
AF_UNSPEC, 0, K_NO_WAIT);
if (!pkt) {
LOG_ERR("No buf available");
goto out;

4
drivers/ieee802154/ieee802154_nrf5.c
View file

@ -380,8 +380,8 @@ static int handle_ack(struct nrf5_802154_data *nrf5_radio)
ack_len = nrf5_radio->ack_frame.psdu[0] - NRF5_FCS_LENGTH;
}
ack_pkt = net_pkt_alloc_with_buffer(nrf5_radio->iface, ack_len,
AF_UNSPEC, 0, K_NO_WAIT);
ack_pkt = net_pkt_rx_alloc_with_buffer(nrf5_radio->iface, ack_len,
AF_UNSPEC, 0, K_NO_WAIT);
if (!ack_pkt) {
LOG_ERR("No free packet available.");
err = -ENOMEM;

6
drivers/ieee802154/ieee802154_rf2xx.c
View file

@ -165,7 +165,7 @@ static void rf2xx_trx_rx(const struct device *dev)
/*
* The rf2xx frame buffer can have length > 128 bytes. The
* net_pkt_alloc_with_buffer allocates max value of 128 bytes.
* net_pkt_rx_alloc_with_buffer allocates max value of 128 bytes.
*
* This obligate the driver to have rx_buf statically allocated with
* RX2XX_MAX_FRAME_SIZE.
@ -204,8 +204,8 @@ static void rf2xx_trx_rx(const struct device *dev)
pkt_len -= RX2XX_FRAME_FCS_LENGTH;
}
pkt = net_pkt_alloc_with_buffer(ctx->iface, pkt_len,
AF_UNSPEC, 0, K_NO_WAIT);
pkt = net_pkt_rx_alloc_with_buffer(ctx->iface, pkt_len,
AF_UNSPEC, 0, K_NO_WAIT);
if (!pkt) {
LOG_ERR("No buf available");