blob: f618833989c240852bb17ae73df4a20592003189 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
From 7d8eef201fb057dee26eae4e2c419486bae4b5cb Mon Sep 17 00:00:00 2001
From: Sebastiaan de Schaetzen <sebastiaan.de.schaetzen@gmail.com>
Date: Tue, 27 Jul 2021 15:06:57 +0200
Subject: [PATCH 1/3] rtos/riot: fix out-of-bounds writes when target is
corrupted
This protects against out-of-bounds writes when the memory
of RIOT's scheduler is corrupted.
This memory can be corrupted because of:
- Programming errors
- The scheduler not yet having been initialised
- An incorrect symbol file being used during debugging.
This error can result in OpenOCD segfaulting. Valgrind was
used to find the approximate location of the error.
Change-Id: I60e7d7c245b8c4e38f4c98cb0c0347a9b5ec3177
Signed-off-by: Sebastiaan de Schaetzen <sebastiaan.de.schaetzen@gmail.com>
---
src/rtos/riot.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/src/rtos/riot.c b/src/rtos/riot.c
index fb5d1b29d..fccc53429 100644
--- a/src/rtos/riot.c
+++ b/src/rtos/riot.c
@@ -118,7 +118,7 @@ const struct rtos_type riot_rtos = {
static int riot_update_threads(struct rtos *rtos)
{
int retval;
- unsigned int tasks_found = 0;
+ int tasks_found = 0;
const struct riot_params *param;
if (!rtos)
@@ -170,7 +170,6 @@ static int riot_update_threads(struct rtos *rtos)
riot_symbol_list[RIOT_NUM_THREADS]);
return retval;
}
- rtos->thread_count = thread_count;
/* read the maximum number of threads */
uint8_t max_threads = 0;
@@ -182,6 +181,11 @@ static int riot_update_threads(struct rtos *rtos)
riot_symbol_list[RIOT_MAX_THREADS]);
return retval;
}
+ if (thread_count > max_threads) {
+ LOG_ERROR("Thread count is invalid");
+ return ERROR_FAIL;
+ }
+ rtos->thread_count = thread_count;
/* Base address of thread array */
uint32_t threads_base = rtos->symbols[RIOT_THREADS_BASE].address;
@@ -211,6 +215,9 @@ static int riot_update_threads(struct rtos *rtos)
char buffer[32];
for (unsigned int i = 0; i < max_threads; i++) {
+ if (tasks_found == rtos->thread_count)
+ break;
+
/* get pointer to tcb_t */
uint32_t tcb_pointer = 0;
retval = target_read_u32(rtos->target,
--
2.32.0
|