Skip to content

Commit f0ddf8d

Browse files
committed
dcd_nrf5x: ISO OUT handling
For incoming ISO OUT packets it was possible to start DMA from endpoint to RAM before transfer was started resulting in unrelated memory corruption. This is scenario that causes memory corruption: - ISO OUT packet is received - Packet is transferred by DMA to transfer buffer - xfer->started is cleared and xfer->buffer is updated as it is in every case - Application takes to long to handle it (it happens when debugger is connected breakpoint is hit slowing down software). - Next ISO OUT packet arrives At this point there was no check if transfer was started and packet was copied by DMA to location beyond previous data, possibly overwriting unrelated memory. This solves the issue by checking that transfer was started and there is buffer ready for incoming packet.
1 parent 990fb6a commit f0ddf8d

File tree

1 file changed

+9
-4
lines changed

1 file changed

+9
-4
lines changed

src/portable/nordic/nrf5x/dcd_nrf5x.c

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -187,11 +187,16 @@ static void xact_out_dma(uint8_t epnum)
187187
}
188188
else
189189
{
190-
// Trigger DMA move data from Endpoint -> SRAM
191-
NRF_USBD->ISOOUT.PTR = (uint32_t) xfer->buffer;
192-
NRF_USBD->ISOOUT.MAXCNT = xact_len;
190+
if (xfer->started)
191+
{
192+
// Trigger DMA move data from Endpoint -> SRAM
193+
NRF_USBD->ISOOUT.PTR = (uint32_t) xfer->buffer;
194+
NRF_USBD->ISOOUT.MAXCNT = xact_len;
193195

194-
start_dma(&NRF_USBD->TASKS_STARTISOOUT);
196+
start_dma(&NRF_USBD->TASKS_STARTISOOUT);
197+
} else {
198+
atomic_flag_clear(&_dcd.dma_running);
199+
}
195200
}
196201
}
197202
else

0 commit comments

Comments
 (0)