Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

HARD FAULT: Add sanity check to sx126x driver when handling retention list #72

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

MarekNovakACRIOS
Copy link

If an invalid value is read and present in buffer[0], then :

if( register_addr[index] == ( ( uint16_t ) register_list[2 * i] << 8 ) + register_list[2 * i + 1] )

here happens reading out of bounds of the buffer[] array.
Even more - the buffer[0] is made on stack:

uint8_t buffer[9] = {0};

Which is ok, but in combination with the bug above and with the fact, that the stack is in 99.9% cases placed at the end of the RAM, this will cause reading values in an address which is out of bound of RAM/SRAM and therefore a hardfault/memfault/crash will be generated.

The issue can happen and an invalid value can be read out of SX1261 due to power variation, EMC, etc.. and happened to me, when stressing and testing my hardware and generating variations of power of SX1261 close to the allowed voltage area.

This should not happen during normal operation, but it CAN happen - and it is not ok to take down the whole microcontroller system in that case.

@MarekNovakACRIOS
Copy link
Author

Also backported for loramac-node: Lora-net/LoRaMac-node#1615

@MarekNovakACRIOS MarekNovakACRIOS changed the title Add sanity check to sx126x driver when handling retention list HARD FAULT: Add sanity check to sx126x driver when handling retention list Jul 3, 2024
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant