Skip to content

Commit e72d190

Browse files
committed
[nrf fromtree] drivers: ieee802154: nrf5: drop packets that are too long
There was an observed situation where the assert checking frame length is below 128 bytes was hit. While the nrf-802154 checks that the frame does not exceed that size, there might exists code paths that allow such packets to pass through. The change removes the assert and drops the packet instead. An error is also printed to allow for further debugging. Signed-off-by: Rafał Kuźnia <[email protected]> (cherry picked from commit 5925d71)
1 parent 8cba1f6 commit e72d190

File tree

1 file changed

+9
-2
lines changed

1 file changed

+9
-2
lines changed

drivers/ieee802154/ieee802154_nrf5.c

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,12 @@ static void nrf5_rx_thread(void *arg1, void *arg2, void *arg3)
179179
}
180180

181181
#if defined(CONFIG_NET_BUF_DATA_SIZE)
182-
__ASSERT_NO_MSG(pkt_len <= CONFIG_NET_BUF_DATA_SIZE);
182+
if (pkt_len > CONFIG_NET_BUF_DATA_SIZE) {
183+
LOG_ERR("Received a frame exceeding the buffer size (%u): %u",
184+
CONFIG_NET_BUF_DATA_SIZE, pkt_len);
185+
LOG_HEXDUMP_ERR(rx_frame->psdu, rx_frame->psdu[0] + 1, "Received PSDU");
186+
goto drop;
187+
}
183188
#endif
184189

185190
LOG_DBG("Frame received");
@@ -232,7 +237,9 @@ static void nrf5_rx_thread(void *arg1, void *arg2, void *arg3)
232237
rx_frame->psdu = NULL;
233238
nrf_802154_buffer_free_raw(psdu);
234239

235-
net_pkt_unref(pkt);
240+
if (pkt) {
241+
net_pkt_unref(pkt);
242+
}
236243
}
237244
}
238245

0 commit comments

Comments
 (0)