Code Review / openocd.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | review | tree
raw | inline | side by side
rtos/riot: fix out-of-bounds writes when target is corrupted
[openocd.git] / src / rtos / riot.c
diff --git a/src/rtos/riot.c b/src/rtos/riot.c
index 6652db651104cf39e63b0502f12e557758132b48..8a3874202f33ce10329258e57a219574a74c7c12 100644 (file)
--- a/src/rtos/riot.c
+++ b/src/rtos/riot.c
@@ -91,19 +91,19 @@ enum riot_symbol_values {
        RIOT_NAME_OFFSET,
 };
 
-/* refer RIOT core/sched.c */
-static const char *const riot_symbol_list[] = {
-       "sched_threads",
-       "sched_num_threads",
-       "sched_active_pid",
-       "max_threads",
-       "_tcb_name_offset",
-       NULL
+struct riot_symbol {
+       const char *const name;
+       bool optional;
 };
 
-/* Define which symbols are not mandatory */
-static const enum riot_symbol_values riot_optional_symbols[] = {
-       RIOT_NAME_OFFSET,
+/* refer RIOT core/sched.c */
+static struct riot_symbol const riot_symbol_list[] = {
+       {"sched_threads", false},
+       {"sched_num_threads", false},
+       {"sched_active_pid", false},
+       {"max_threads", false},
+       {"_tcb_name_offset", true},
+       {NULL, false}
 };
 
 const struct rtos_type riot_rtos = {
@@ -118,7 +118,7 @@ const struct rtos_type riot_rtos = {
 static int riot_update_threads(struct rtos *rtos)
 {
        int retval;
-       unsigned int tasks_found = 0;
+       int tasks_found = 0;
        const struct riot_params *param;
 
        if (!rtos)
@@ -136,7 +136,7 @@ static int riot_update_threads(struct rtos *rtos)
 
        if (rtos->symbols[RIOT_THREADS_BASE].address == 0) {
                LOG_ERROR("Can't find symbol `%s`",
-                       riot_symbol_list[RIOT_THREADS_BASE]);
+                       riot_symbol_list[RIOT_THREADS_BASE].name);
                return ERROR_FAIL;
        }
 
@@ -154,7 +154,7 @@ static int riot_update_threads(struct rtos *rtos)
                        (uint16_t *)&active_pid);
        if (retval != ERROR_OK) {
                LOG_ERROR("Can't read symbol `%s`",
-                       riot_symbol_list[RIOT_ACTIVE_PID]);
+                       riot_symbol_list[RIOT_ACTIVE_PID].name);
                return retval;
        }
        rtos->current_thread = active_pid;
@@ -167,10 +167,9 @@ static int riot_update_threads(struct rtos *rtos)
                        (uint16_t *)&thread_count);
        if (retval != ERROR_OK) {
                LOG_ERROR("Can't read symbol `%s`",
-                       riot_symbol_list[RIOT_NUM_THREADS]);
+                       riot_symbol_list[RIOT_NUM_THREADS].name);
                return retval;
        }
-       rtos->thread_count = thread_count;
 
        /* read the maximum number of threads */
        uint8_t max_threads = 0;
@@ -179,9 +178,14 @@ static int riot_update_threads(struct rtos *rtos)
                        &max_threads);
        if (retval != ERROR_OK) {
                LOG_ERROR("Can't read symbol `%s`",
-                       riot_symbol_list[RIOT_MAX_THREADS]);
+                       riot_symbol_list[RIOT_MAX_THREADS].name);
                return retval;
        }
+       if (thread_count > max_threads) {
+               LOG_ERROR("Thread count is invalid");
+               return ERROR_FAIL;
+       }
+       rtos->thread_count = thread_count;
 
        /* Base address of thread array */
        uint32_t threads_base = rtos->symbols[RIOT_THREADS_BASE].address;
@@ -195,7 +199,7 @@ static int riot_update_threads(struct rtos *rtos)
                                &name_offset);
                if (retval != ERROR_OK) {
                        LOG_ERROR("Can't read symbol `%s`",
-                               riot_symbol_list[RIOT_NAME_OFFSET]);
+                               riot_symbol_list[RIOT_NAME_OFFSET].name);
                        return retval;
                }
        }
@@ -211,13 +215,17 @@ static int riot_update_threads(struct rtos *rtos)
        char buffer[32];
 
        for (unsigned int i = 0; i < max_threads; i++) {
+               if (tasks_found == rtos->thread_count)
+                       break;
+
                /* get pointer to tcb_t */
                uint32_t tcb_pointer = 0;
                retval = target_read_u32(rtos->target,
                                threads_base + (i * 4),
                                &tcb_pointer);
                if (retval != ERROR_OK) {
-                       LOG_ERROR("Can't parse `%s`", riot_symbol_list[RIOT_THREADS_BASE]);
+                       LOG_ERROR("Can't parse `%s`",
+                               riot_symbol_list[RIOT_THREADS_BASE].name);
                        goto error;
                }
 
@@ -235,7 +243,8 @@ static int riot_update_threads(struct rtos *rtos)
                                tcb_pointer + param->thread_status_offset,
                                &status);
                if (retval != ERROR_OK) {
-                       LOG_ERROR("Can't parse `%s`", riot_symbol_list[RIOT_THREADS_BASE]);
+                       LOG_ERROR("Can't parse `%s`",
+                               riot_symbol_list[RIOT_THREADS_BASE].name);
                        goto error;
                }
 
@@ -269,7 +278,7 @@ static int riot_update_threads(struct rtos *rtos)
                                        &name_pointer);
                        if (retval != ERROR_OK) {
                                LOG_ERROR("Can't parse `%s`",
-                                       riot_symbol_list[RIOT_THREADS_BASE]);
+                                       riot_symbol_list[RIOT_THREADS_BASE].name);
                                goto error;
                        }
 
@@ -280,7 +289,7 @@ static int riot_update_threads(struct rtos *rtos)
                                        (uint8_t *)&buffer);
                        if (retval != ERROR_OK) {
                                LOG_ERROR("Can't parse `%s`",
-                                       riot_symbol_list[RIOT_THREADS_BASE]);
+                                       riot_symbol_list[RIOT_THREADS_BASE].name);
                                goto error;
                        }
 
@@ -339,7 +348,7 @@ static int riot_get_thread_reg_list(struct rtos *rtos, int64_t thread_id,
                        threads_base + (thread_id * 4),
                        &tcb_pointer);
        if (retval != ERROR_OK) {
-               LOG_ERROR("Can't parse `%s`", riot_symbol_list[RIOT_THREADS_BASE]);
+               LOG_ERROR("Can't parse `%s`", riot_symbol_list[RIOT_THREADS_BASE].name);
                return retval;
        }
 
@@ -349,7 +358,7 @@ static int riot_get_thread_reg_list(struct rtos *rtos, int64_t thread_id,
                        tcb_pointer + param->thread_sp_offset,
                        &stackptr);
        if (retval != ERROR_OK) {
-               LOG_ERROR("Can't parse `%s`", riot_symbol_list[RIOT_THREADS_BASE]);
+               LOG_ERROR("Can't parse `%s`", riot_symbol_list[RIOT_THREADS_BASE].name);
                return retval;
        }
 
@@ -370,16 +379,8 @@ static int riot_get_symbol_list_to_lookup(struct symbol_table_elem *symbol_list[
        }
 
        for (unsigned int i = 0; i < ARRAY_SIZE(riot_symbol_list); i++) {
-               (*symbol_list)[i].symbol_name = riot_symbol_list[i];
-               (*symbol_list)[i].optional = false;
-
-               /* Lookup if symbol is optional */
-               for (unsigned int k = 0; k < sizeof(riot_optional_symbols); k++) {
-                       if (i == riot_optional_symbols[k]) {
-                               (*symbol_list)[i].optional = true;
-                               break;
-                       }
-               }
+               (*symbol_list)[i].symbol_name = riot_symbol_list[i].name;
+               (*symbol_list)[i].optional = riot_symbol_list[i].optional;
        }
 
        return ERROR_OK;
@@ -401,7 +402,7 @@ static int riot_create(struct target *target)
 
        /* lookup if target is supported by RIOT */
        while ((i < RIOT_NUM_PARAMS) &&
-               (0 != strcmp(riot_params_list[i].target_name, target->type->name))) {
+               (strcmp(riot_params_list[i].target_name, target->type->name) != 0)) {
                i++;
        }
        if (i >= RIOT_NUM_PARAMS) {
Open On-Chip Debugger

Linking to existing account procedure

If you already have an account and want to add another login method you MUST first sign in with your existing account and then change URL to read https://review.openocd.org/login/?link to get to this page again but this time it'll work for linking. Thank you.

SSH host keys fingerprints

1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=..              |
|+o..   .         |
|*.o   . .        |
|+B . . .         |
|Bo. = o S        |
|Oo.+ + =         |
|oB=.* = . o      |
| =+=.+   + E     |
|. .=o   . o      |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)