search

Lora-net / SWL2001

LoRa Basics Modem LoRaWAN stack
BSD 3-Clause Clear License
104 stars 60 forks source link

HARD FAULT: Add sanity check to sx126x driver when handling retention list #72

Open MarekNovakACRIOS opened 3 months ago

MarekNovakACRIOS commented 3 months ago

If an invalid value is read and present in buffer[0], then :

if( register_addr[index] == ( ( uint16_t ) register_list[2 * i] << 8 ) + register_list[2 * i + 1] )

here happens reading out of bounds of the buffer[] array. Even more - the buffer[0] is made on stack:

uint8_t buffer[9] = {0};

Which is ok, but in combination with the bug above and with the fact, that the stack is in 99.9% cases placed at the end of the RAM, this will cause reading values in an address which is out of bound of RAM/SRAM and therefore a hardfault/memfault/crash will be generated.

The issue can happen and an invalid value can be read out of SX1261 due to power variation, EMC, etc.. and happened to me, when stressing and testing my hardware and generating variations of power of SX1261 close to the allowed voltage area.

This should not happen during normal operation, but it CAN happen - and it is not ok to take down the whole microcontroller system in that case.

MarekNovakACRIOS commented 3 months ago

Also backported for loramac-node: https://github.com/Lora-net/LoRaMac-node/pull/1615