drivers: ieee802154: don't allocate rx pkt from tx pool

Several IEEE 802154 drivers allocated RX packets from the TX pool.

This may seem like a minor problem at first sight but it may become
problematic if the pool is used to distinguish package types as is the
case in some code paths, e.g. for packet priority or determination of
the packet buffer pool.

This bug also has the potential of starving the TX pool capacity which
even may make devices vulnerable to DoS attacks as sending may be
prohibited by addressing enough RX packets to a device to let it run out
of TX capacity.

Fixes: #51261

Signed-off-by: Florian Grandel <[email protected]>

Author: Florian Grandel

drivers/ieee802154/ieee802154_b91.c

@@ -206,8 +206,8 @@ static void b91_handle_ack(void)
 	struct net_pkt *ack_pkt;
 
 	/* allocate ack packet */
-	ack_pkt = net_pkt_alloc_with_buffer(data.iface, B91_ACK_FRAME_LEN,
-					    AF_UNSPEC, 0, K_NO_WAIT);
+	ack_pkt = net_pkt_rx_alloc_with_buffer(data.iface, B91_ACK_FRAME_LEN,
+					       AF_UNSPEC, 0, K_NO_WAIT);
 	if (!ack_pkt) {
 		LOG_ERR("No free packet available.");
 		return;
@@ -301,7 +301,7 @@ static void b91_rf_rx_isr(void)
 		}
 
 		/* get packet pointer from NET stack */
-		pkt = net_pkt_alloc_with_buffer(data.iface, length, AF_UNSPEC, 0, K_NO_WAIT);
+		pkt = net_pkt_rx_alloc_with_buffer(data.iface, length, AF_UNSPEC, 0, K_NO_WAIT);
 		if (!pkt) {
 			LOG_ERR("No pkt available");
 			goto exit;

drivers/ieee802154/ieee802154_cc1200.c

@@ -466,8 +466,8 @@ static void cc1200_rx(void *arg)
 			goto flush;
 		}
 
-		pkt = net_pkt_alloc_with_buffer(cc1200->iface, pkt_len,
-						AF_UNSPEC, 0, K_NO_WAIT);
+		pkt = net_pkt_rx_alloc_with_buffer(cc1200->iface, pkt_len,
+						   AF_UNSPEC, 0, K_NO_WAIT);
 		if (!pkt) {
 			LOG_ERR("No free pkt available");
 			goto flush;

drivers/ieee802154/ieee802154_cc2520.c

@@ -616,8 +616,8 @@ static void cc2520_rx(void *arg)
 			goto flush;
 		}
 
-		pkt = net_pkt_alloc_with_buffer(cc2520->iface, pkt_len,
-						AF_UNSPEC, 0, K_NO_WAIT);
+		pkt = net_pkt_rx_alloc_with_buffer(cc2520->iface, pkt_len,
+						   AF_UNSPEC, 0, K_NO_WAIT);
 		if (!pkt) {
 			LOG_ERR("No pkt available");
 			goto flush;

drivers/ieee802154/ieee802154_dw1000.c

@@ -420,8 +420,8 @@ static inline void dwt_irq_handle_rx(const struct device *dev, uint32_t sys_stat
 		pkt_len -= DWT_FCS_LENGTH;
 	}
 
-	pkt = net_pkt_alloc_with_buffer(ctx->iface, pkt_len,
-					AF_UNSPEC, 0, K_NO_WAIT);
+	pkt = net_pkt_rx_alloc_with_buffer(ctx->iface, pkt_len,
+					   AF_UNSPEC, 0, K_NO_WAIT);
 	if (!pkt) {
 		LOG_ERR("No buf available");
 		goto rx_out_enable_rx;

drivers/ieee802154/ieee802154_kw41z.c

@@ -514,8 +514,8 @@ static inline void kw41z_rx(struct kw41z_context *kw41z, uint8_t len)
 	pkt_len = len - KW41Z_FCS_LENGTH;
 #endif
 
-	pkt = net_pkt_alloc_with_buffer(kw41z->iface, pkt_len,
-					AF_UNSPEC, 0, K_NO_WAIT);
+	pkt = net_pkt_rx_alloc_with_buffer(kw41z->iface, pkt_len,
+					   AF_UNSPEC, 0, K_NO_WAIT);
 	if (!pkt) {
 		LOG_ERR("No buf available");
 		goto out;
@@ -582,8 +582,8 @@ static void handle_ack(struct kw41z_context *kw41z, uint8_t seq_number)
 	struct net_pkt *ack_pkt;
 	uint8_t ack_psdu[ACK_FRAME_LEN];
 
-	ack_pkt = net_pkt_alloc_with_buffer(kw41z->iface, ACK_FRAME_LEN,
-					    AF_UNSPEC, 0, K_NO_WAIT);
+	ack_pkt = net_pkt_rx_alloc_with_buffer(kw41z->iface, ACK_FRAME_LEN,
+					       AF_UNSPEC, 0, K_NO_WAIT);
 	if (!ack_pkt) {
 		LOG_ERR("No free packet available.");
 		return;

drivers/ieee802154/ieee802154_mcr20a.c

@@ -557,8 +557,8 @@ static inline void mcr20a_rx(const struct device *dev, uint8_t len)
 
 	pkt_len = len - MCR20A_FCS_LENGTH;
 
-	pkt = net_pkt_alloc_with_buffer(mcr20a->iface, pkt_len,
-					AF_UNSPEC, 0, K_NO_WAIT);
+	pkt = net_pkt_rx_alloc_with_buffer(mcr20a->iface, pkt_len,
+					   AF_UNSPEC, 0, K_NO_WAIT);
 	if (!pkt) {
 		LOG_ERR("No buf available");
 		goto out;

drivers/ieee802154/ieee802154_nrf5.c

@@ -380,8 +380,8 @@ static int handle_ack(struct nrf5_802154_data *nrf5_radio)
 		ack_len = nrf5_radio->ack_frame.psdu[0] - NRF5_FCS_LENGTH;
 	}
 
-	ack_pkt = net_pkt_alloc_with_buffer(nrf5_radio->iface, ack_len,
-					    AF_UNSPEC, 0, K_NO_WAIT);
+	ack_pkt = net_pkt_rx_alloc_with_buffer(nrf5_radio->iface, ack_len,
+					       AF_UNSPEC, 0, K_NO_WAIT);
 	if (!ack_pkt) {
 		LOG_ERR("No free packet available.");
 		err = -ENOMEM;

drivers/ieee802154/ieee802154_rf2xx.c

@@ -165,7 +165,7 @@ static void rf2xx_trx_rx(const struct device *dev)
 
 	/*
 	 * The rf2xx frame buffer can have length > 128 bytes. The
-	 * net_pkt_alloc_with_buffer allocates max value of 128 bytes.
+	 * net_pkt_rx_alloc_with_buffer allocates max value of 128 bytes.
 	 *
 	 * This obligate the driver to have rx_buf statically allocated with
 	 * RX2XX_MAX_FRAME_SIZE.
@@ -204,8 +204,8 @@ static void rf2xx_trx_rx(const struct device *dev)
 		pkt_len -= RX2XX_FRAME_FCS_LENGTH;
 	}
 
-	pkt = net_pkt_alloc_with_buffer(ctx->iface, pkt_len,
-					AF_UNSPEC, 0, K_NO_WAIT);
+	pkt = net_pkt_rx_alloc_with_buffer(ctx->iface, pkt_len,
+					   AF_UNSPEC, 0, K_NO_WAIT);
 
 	if (!pkt) {
 		LOG_ERR("No buf available");