Skip to content

Conversation

@adamkondraciuk
Copy link

No description provided.

MarkWangChinese and others added 30 commits July 4, 2025 13:10
…rity

The peer uses the RPA address.
A BR connection is created firstly, a subsequent BLE connection is
created secondly, the BR SMP CTKD occur thirdly (The BLE LTK is
derived from BR and the BR SMP distribute peer's IRK and identity address
here), but the BLE LTK is saved to key pool that is not
matched with the previous BLE connection because the derived LTK is saved
with identity address and BLE connection uses RPA. Fix it by: Resolve the
BLE connections' RPA with the derived IRK to find the previous BLE
connections and match the connections with derived LTK key.

Signed-off-by: Mark Wang <[email protected]>
need to consider corner cases of ctkd as the added code comments.

Signed-off-by: Mark Wang <[email protected]>
Some bytes were compared twice and one comparison used wrong index.

Signed-off-by: Robert Lubos <[email protected]>
To address the misaligned access issues reported by UBSAN, introduce raw
variant of certain IPv6 functions used in the critical data path of the
network stack, operating on plain uint8_t buffers in stead of IPv6
address struct.

Signed-off-by: Robert Lubos <[email protected]>
Refactor local functions to work with byte buffers instead of struct
in6_addr and use switch to use raw variants of functions operating on
IPv6 addresses.

Signed-off-by: Robert Lubos <[email protected]>
IPv6 Neighbor Discovery interfaces modules like neighbor or routing
tables - converting them to raw variants seems futile. Therefore, for
IPv6 ND case, copy the raw IP address from the packet into the in6_addr
structure, and then pass it to respective functions. Performance
overhead should not be a big problem in such case as those actions are
only performed if a respective ND packet is received.

Signed-off-by: Robert Lubos <[email protected]>
Rework the rest of the IPv6-related code to avoid casting. Use raw
variants of IPv6-related functions whenever possible (especially on the
critical data path). For the routing case, use a copy of the address to
avoid massive rework of the routing module.

Signed-off-by: Robert Lubos <[email protected]>
To address the misaligned access issues reported by UBSAN, introduce raw
variant of certain IPv4 functions used in the critical data path of the
network stack, operating on plain uint8_t buffers in stead of IPv4
address struct.

Signed-off-by: Robert Lubos <[email protected]>
Rework the IPv4-related code to avoid casting. Use raw variants of
IPv4-related functions whenever possible (especially on the critical
data path).

Signed-off-by: Robert Lubos <[email protected]>
To avoid misalignment errors when casting between
sockaddr_storage/sockaddr and specialied sockaddr_* variants, specify
alignment for the former to match the alignment of the others.

The issue was reported by UBSAN:

  utils.c:802:8: runtime error: member access within misaligned
  address 0xf4aff186 for type 'struct sockaddr_in6', which requires
  4 byte alignment

Signed-off-by: Robert Lubos <[email protected]>
As struct sockaddr have now alignment of 4 bytes, net_ipaddr_copy()
gives the following error if used for sockaddr:

  error: alignment 1 of ‘struct <anonymous>’ is less than 4
  [-Werror=packed-not-aligned]

Just use memcpy() instead, net_ipaddr_copy() was intended to use with IP
addresses, not socket related structs.

Signed-off-by: Robert Lubos <[email protected]>
cmsgbuf pointer can be NULL, therefore verify that before calling
memset() on it.

Signed-off-by: Robert Lubos <[email protected]>
This was caught by UBSAN:

  zvfs_select.c:70:2: runtime error: left shift of 1 by 31 places
  cannot be represented in type 'int'

Signed-off-by: Robert Lubos <[email protected]>
In order to prevent an overflow warning from UBSAN when bitshifting,
cast to uint64_t first before shifting, and then back to uint32_t.

Signed-off-by: Robert Lubos <[email protected]>
In order to avoid alignment issues when casting void pointers to
in(6)_addr structures, create a properly aligned copy of the ip(v6)
address on stack.

Signed-off-by: Robert Lubos <[email protected]>
Cast uint8_t variable to uint32_t explicitly to avoid implicit cast to
int, and thus potentially undefined behavior, reported by UBSAN:

  net_pkt.c:1946:17: runtime error: left shift of 239 by 24 places
  cannot be represented in type 'int'

Signed-off-by: Robert Lubos <[email protected]>
The iface test suite uses two different interface types with two
different context types and iid tests mixed up the two. It attempted
to create a mac address for Ethernet interface (which uses
struct eth_fake_context), however the net_iface_get_mac() function
only works with Dummy interface context (struct net_if_test). In
result the Ethernet interface context was corrupted (mac address
overwritten the promisc_mode flag).

Fix this by extracting mac generation code into a common function, and
use it in the Ethernet iface initialization phase instead of directly in
the test.

This was reported by UBSAN:
  tests/net/iface/src/main.c:239:34: runtime error: load of value 11,
  which is not a valid value for type '_Bool'

Signed-off-by: Robert Lubos <[email protected]>
In case address mode in a packet is none, the address pointer within mhr
struct will not be set. Therefore, the pointer should not be used before
address mode is verified inside ieee802154_check_dst_addr().

This was reported by UBSAN:

  subsys/net/l2/ieee802154ieee802154.c:296:41: runtime error: member
  access within null pointer of type 'struct ieee802154_address_field'

Signed-off-by: Robert Lubos <[email protected]>
socketpair fd regsiters ZVFS_MODE_IFSOCK therefore it should register a
close2() function instead of close().

Signed-off-by: Robert Lubos <[email protected]>
Socket dispatcher (and offloaded implementations in tests) register
fd as ZVFS_MODE_IFSOCK therefore they should register a  close2(
function instead of close().

Signed-off-by: Robert Lubos <[email protected]>
In coap_well_known_core_get(), move the null check for 'resource' before
applying pointer arithmetic ('resource + 1') to avoid undefined behavior
when 'resource == NULL'.

Signed-off-by: Gaetan Perrot <[email protected]>
The function counter_rz_gtm_set_alarm was accessing alarm_cfg->flags and
alarm_cfg->ticks before verifying that alarm_cfg is non-NULL.

This could lead to undefined behavior or crashes if a NULL pointer is
passed.

The pointer check has been moved before any dereference to fix this bug.

Signed-off-by: Gaetan Perrot <[email protected]>
There was an unnecessary nested `if` in `ifx_cat1_counter_init` with the
same condition already checked in the outer block.

This results in dead and redundant code with no functional impact but
harms readability.

The inner `if (rslt != CY_RSLT_SUCCESS)` was removed to clean up the
function.

Signed-off-by: Gaetan Perrot <[email protected]>
Coverity reports a potential integer overflow in the accel_range
computation due to the use of a left shift on an int type.

CID 520269: Unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)

Even though the register value is constrained to 0–3 by the BMA456 spec,
and no real overflow occurs, an explicit cast to int64_t prevents false
positives and aligns with safe coding practices.

Fixes: zephyrproject-rtos#90517

Signed-off-by: Gaetan Perrot <[email protected]>
Peripheral clocks are currently not being disabled for JTAG reset
condition, which causes driver init failures when debugging the SoC
with JTAG. Fix by disabling all clocks for this reset type.

Signed-off-by: Raffael Rostagno <[email protected]>
Fix a bug in zbus_chan_rm_obs() where removing the first observer in a
channel's observer list would cause undefined behavior due to accessing
a member of a NULL pointer.

The issue occurred when prev_obs_nd was NULL (indicating the first node
in the list) and the code attempted to pass &prev_obs_nd->node to
sys_slist_remove(). This resulted in accessing the 'node' member of a
NULL pointer, which is undefined behavior even when taking its address.

The sys_slist_remove() function is designed to handle a NULL prev_node
parameter correctly for removing the first element in a list. The fix
ensures we pass NULL directly instead of attempting to compute the
address of a member within a NULL pointer.

This was detected by Undefined Behavior Sanitizer as "member access
within null pointer".

Signed-off-by: Jan Tore Guggedal <[email protected]>
Virtio headers are moved to zephyr/drivers/ as they have no reason to be
top-level headers since virtio is a driver class.

Signed-off-by: Benjamin Cabé <[email protected]>
Virtio Doxygen documentation is now folded under Device Driver API group
like it should be.

Signed-off-by: Benjamin Cabé <[email protected]>
This reverts commit e8caaf4.

Signed-off-by: Benjamin Cabé <[email protected]>
This reverts commit c68d0b9.

Signed-off-by: Benjamin Cabé <[email protected]>
kartben and others added 29 commits July 11, 2025 15:54
Introduce documentation for using zenoh-pico as an external module in
Zephyr.

Signed-off-by: Benjamin Cabé <[email protected]>
Fix the conditional compilation to use `CONFIG_MBEDTLS_PKCS1_V21`
instead of `CONFIG_MBEDTLS_PKCS1_V15` when enabling `MBEDTLS_PKCS1_V21`.

Signed-off-by: Pisit Sawangvonganan <[email protected]>
Deleted a redundant check for 'rpu_ctx_zep' pointer after it was already
dereferenced.

Clarifies code logic in nrf_wifi_get_power_save_config function.

Signed-off-by: Gaetan Perrot <[email protected]>
The .rodata_in_data section is produced by MWDT toolchain with -Hccm
option enabled. This option moves read-only data from the executable
memory (ICCM) to the data memory (DCCM), improving performance by
reducing conflicts between instruction fetches and data fetches.

Signed-off-by: Ilya Tagunov <[email protected]>
Fixes correct GATT characteristic description for Device Time.

Signed-off-by: Dipak Shetty <[email protected]>
Offloaded socket implementations need to create the socket operations
vtable, therefore need access to struct socket_op_vtable. So far this
has been defined in a private header, so implementations needed to add
the header location to the include path in CMake.

Therefore, move struct socket_op_vtable definition to the internal part
of the public socket header, so it's no longer needed to include a
private header. This is also more consistent with the rest of the public
header content, as for example macros needed to register a socket
implementation are already there.

Signed-off-by: Robert Lubos <[email protected]>
Ensure 'params' is not NULL before accessing its fields.

Prevents possible null pointer dereference when calling
strlen(params->ssid).

Delay access to ssid->ssid and ssid->ssid_len until after null check.

Prevents potential crash if wpa_s->current_ssid is NULL.

Signed-off-by: Gaetan Perrot <[email protected]>
Move usage of ap_ctx pointers after null checks to prevent potential
crashes.

Signed-off-by: Gaetan Perrot <[email protected]>
Move usage of ap_ctx pointers after null checks to prevent potential
crashes.

Signed-off-by: Gaetan Perrot <[email protected]>
Commit 65471a6 separated
compiler flags into ASM, C and CXX as those flags may not be
universal to both assembler and compiler. Though, with that
separation, the assembler no longer gets the optimization
flags (e.g. speed/size optimizations). So adds this back so
the assembler can optimize the code if it chooses to. For
example, some instructions can be fused together to result
in small code.

Fixes zephyrproject-rtos#92439

Signed-off-by: Daniel Leung <[email protected]>
USB_OTG_HS_EMB_PHY macro is always defined, so
`defined(USB_OTG_HS_EMB_PHY)` always results in true. This means that
driver always selected `USB_OTG_SPEED_HIGH_IN_FULL` and never
`USB_OTG_SPEED_HIGH`.

Fix that by checking value of defined macro.

Signed-off-by: Marcin Niestroj <[email protected]>
When adding new fsbl variant this sample Kconfig overlay was missed
leading to non functional sample on this variant.

Signed-off-by: Erwan Gouriou <[email protected]>
It's unused.

Signed-off-by: Tomi Fontanilles <[email protected]>
Coverity (CID 516253) reported that the return value of
initialize_tx_with_sid_disabled() was set but not used, leading to
potential silent failures.

Check if the return value is negative and propagate the error through the
existing cleanup path.

Fixes: CID 516253

Signed-off-by: Gaetan Perrot <[email protected]>
To optimize power consumption, the inputmux clock is only enabled when
a signal is attached.

Signed-off-by: Derek Snell <[email protected]>
Set version to v4.2.0-rc3.

Signed-off-by: Dan Kalowsky <[email protected]>
Signed-off-by: Daniel DeGrasse <[email protected]>
Enable double buffering on data OUT endpoints to allow USB stack to
enqueue next transfer as soon as possible. This is especially useful
when operating at High-Speed where there is significantly less time
between subsequent SOF packets.

Signed-off-by: Tomasz Moń <[email protected]>
Release receive buffer on failed endpoint enqueue.

Signed-off-by: Tomasz Moń <[email protected]>
Enable double buffering on isochronous feedback endpoint to avoid
sending ZLP instead of feedback information.

Signed-off-by: Tomasz Moń <[email protected]>
Rearm isochronous endpoints when handling incomplete iso out interrupt
to make it possible to rearm the endpoint in time (before SOF),
especially when operating at High-Speed.

Signed-off-by: Tomasz Moń <[email protected]>
Stop processing microphone data on error or when streaming ends. This
avoids I2S read timeouts due to audio data not being available while
streaming.

Signed-off-by: Tomasz Moń <[email protected]>
Place I2S buffer in memory location that can be used directly by the TDM
peripheral without DMM bouncing.

Signed-off-by: Tomasz Moń <[email protected]>
Allow the samples to work both at Full-Speed and High-Speed exposing the
same capabilities at both speeds.

Signed-off-by: Tomasz Moń <[email protected]>
Signed-off-by: Marcin Szymczyk <[email protected]>
Reserve memory in RAM3x for TDM on FLPR.
Disable can120 to use 9.4 and 9.5 for debugging.

Signed-off-by: Krzysztof Chruściński <[email protected]>
Enable STM logging in the sample.

Signed-off-by: Krzysztof Chruściński <[email protected]>
Add buffer management in flpr. TDM data is ready for USB.

Signed-off-by: Krzysztof Chruściński <[email protected]>
Extend TDM configuration. For now the configuration requires three parameters:
- ISO_IN_CH_CNT - defines also number of TDM RX channels
- ISO_OUT_CH_CNT - defines also number of TDM TX channels
- TDM_WORD_SIZE - defines also `sample_t` type

Signed-off-by: Adam Kondraciuk <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet