Skip to content
This repository was archived by the owner on Sep 16, 2024. It is now read-only.

Commit e932a94

Browse files
peter-pycommsariisik
authored andcommitted
lora: Fix losing of multicast params
we're allocating MulticastParams_t inside garbage collected memory, then pass it into the C-level implementation. It seems the garbage collector cannot keep track of the usage this way, so eventually recycles the memory. At that point we lose the multicast addresses and when we check it in LoraMac.c: 842 case FRAME_TYPE_DATA_CONFIRMED_DOWN: case FRAME_TYPE_DATA_UNCONFIRMED_DOWN: and further we end up dereferencing those pointers still and then it's a bit random whether we core dump due to illegal memory address, or simply ignore the lora packets and become "deaf" to them
1 parent 04a4454 commit e932a94

File tree

1 file changed

+9
-7
lines changed

1 file changed

+9
-7
lines changed

esp32/mods/modlora.c

+9-7
Original file line numberDiff line numberDiff line change
@@ -1993,26 +1993,28 @@ STATIC mp_obj_t lora_join_multicast_group (mp_uint_t n_args, const mp_obj_t *pos
19931993
{ MP_QSTR_mcNwkKey, MP_ARG_REQUIRED | MP_ARG_OBJ, {.u_obj = MP_OBJ_NULL} },
19941994
{ MP_QSTR_mcAppKey, MP_ARG_REQUIRED | MP_ARG_OBJ, {.u_obj = MP_OBJ_NULL} },
19951995
};
1996-
1996+
19971997
// parse args
19981998
mp_arg_val_t args[MP_ARRAY_SIZE(allowed_args)];
19991999
mp_arg_parse_all(n_args - 1, pos_args + 1, kw_args, MP_ARRAY_SIZE(args), allowed_args, args);
2000-
2000+
20012001
mp_buffer_info_t bufinfo_0, bufinfo_1;
20022002
mp_get_buffer_raise(args[1].u_obj, &bufinfo_0, MP_BUFFER_READ);
20032003
mp_get_buffer_raise(args[2].u_obj, &bufinfo_1, MP_BUFFER_READ);
2004-
2005-
MulticastParams_t *channelParam = m_new_obj(MulticastParams_t);
2004+
2005+
MulticastParams_t *channelParam = heap_caps_malloc(sizeof(MulticastParams_t), MALLOC_CAP_SPIRAM);
20062006
channelParam->Next = NULL;
20072007
channelParam->DownLinkCounter = 0;
20082008
channelParam->Address = args[0].u_int;
20092009
memcpy(channelParam->NwkSKey, bufinfo_0.buf, sizeof(channelParam->NwkSKey));
20102010
memcpy(channelParam->AppSKey, bufinfo_1.buf, sizeof(channelParam->AppSKey));
2011-
2011+
20122012
if (LoRaMacMulticastChannelLink(channelParam) == LORAMAC_STATUS_OK) {
20132013
return mp_const_true;
20142014
}
2015-
2015+
2016+
// adding to the list failed, so free the memory again
2017+
free(channelParam);
20162018
return mp_const_false;
20172019
}
20182020
STATIC MP_DEFINE_CONST_FUN_OBJ_KW(lora_join_multicast_group_obj, 0, lora_join_multicast_group);
@@ -2021,7 +2023,7 @@ STATIC mp_obj_t lora_leave_multicast_group (mp_obj_t self_in, mp_obj_t multicast
20212023
uint32_t mcAddr = mp_obj_get_int(multicast_addr_obj);
20222024
MulticastParams_t *channelParam = LoRaMacMulticastGetChannel(mcAddr);
20232025
if (LoRaMacMulticastChannelUnlink(channelParam) == LORAMAC_STATUS_OK) {
2024-
m_del_obj(MulticastParams_t, channelParam);
2026+
free(channelParam);
20252027
return mp_const_true;
20262028
}
20272029
return mp_const_false;

0 commit comments

Comments
 (0)