From e72d190c3139b008e947cd52f49cb5eb8573f25e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Ku=C5=BAnia?= Date: Wed, 16 Jul 2025 14:44:03 +0200 Subject: [PATCH 1/2] [nrf fromtree] drivers: ieee802154: nrf5: drop packets that are too long MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There was an observed situation where the assert checking frame length is below 128 bytes was hit. While the nrf-802154 checks that the frame does not exceed that size, there might exists code paths that allow such packets to pass through. The change removes the assert and drops the packet instead. An error is also printed to allow for further debugging. Signed-off-by: Rafał Kuźnia (cherry picked from commit 5925d718eff7324a5925e4b07885753c3ae80513) --- drivers/ieee802154/ieee802154_nrf5.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/ieee802154/ieee802154_nrf5.c b/drivers/ieee802154/ieee802154_nrf5.c index 25ec35961c7..e5051e731f4 100644 --- a/drivers/ieee802154/ieee802154_nrf5.c +++ b/drivers/ieee802154/ieee802154_nrf5.c @@ -179,7 +179,12 @@ static void nrf5_rx_thread(void *arg1, void *arg2, void *arg3) } #if defined(CONFIG_NET_BUF_DATA_SIZE) - __ASSERT_NO_MSG(pkt_len <= CONFIG_NET_BUF_DATA_SIZE); + if (pkt_len > CONFIG_NET_BUF_DATA_SIZE) { + LOG_ERR("Received a frame exceeding the buffer size (%u): %u", + CONFIG_NET_BUF_DATA_SIZE, pkt_len); + LOG_HEXDUMP_ERR(rx_frame->psdu, rx_frame->psdu[0] + 1, "Received PSDU"); + goto drop; + } #endif LOG_DBG("Frame received"); @@ -232,7 +237,9 @@ static void nrf5_rx_thread(void *arg1, void *arg2, void *arg3) rx_frame->psdu = NULL; nrf_802154_buffer_free_raw(psdu); - net_pkt_unref(pkt); + if (pkt) { + net_pkt_unref(pkt); + } } } From 6b6616b5d17b081cb471e3035758242d9bd9ff6f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Ku=C5=BAnia?= Date: Mon, 14 Jul 2025 14:51:13 +0200 Subject: [PATCH 2/2] [nrf fromtree] drivers: ieee802154: nrf5: prevent negative timestamps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The nrf-802154 driver may be unable to acquire a valid timestamp under rare conditions. In such case, the nrf_802154_received_timestamp_raw reports time=NRF_802154_NO_TIMESTAMP. The shim implementation must not calculate the PHR timestamp when receiving this value, because doing so results in an assert in ptp_packet.h due to a negative time value. When the driver is unable to capture the timestamp, the packet is assigned zero as its timestamp. Signed-off-by: Rafał Kuźnia (cherry picked from commit 3cccfa5f6494677e821255ca162e452285607378) --- drivers/ieee802154/ieee802154_nrf5.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/ieee802154/ieee802154_nrf5.c b/drivers/ieee802154/ieee802154_nrf5.c index e5051e731f4..aa67a1f99e1 100644 --- a/drivers/ieee802154/ieee802154_nrf5.c +++ b/drivers/ieee802154/ieee802154_nrf5.c @@ -1121,8 +1121,12 @@ void nrf_802154_received_timestamp_raw(uint8_t *data, int8_t power, uint8_t lqi, nrf5_data.rx_frames[i].lqi = lqi; #if defined(CONFIG_NET_PKT_TIMESTAMP) - nrf5_data.rx_frames[i].time = - nrf_802154_timestamp_end_to_phr_convert(time, data[0]); + if (time != NRF_802154_NO_TIMESTAMP) { + nrf5_data.rx_frames[i].time = + nrf_802154_timestamp_end_to_phr_convert(time, data[0]); + } else { + nrf5_data.rx_frames[i].time = 0; + } #endif nrf5_data.rx_frames[i].ack_fpb = nrf5_data.last_frame_ack_fpb;