at86rf2xx: release framebuffer on recv with (len > 0) && (buf == NULL) [backport 2018.10]#10285
Conversation
This PR sets the tranceiver in PLL_ON state to avoid corruption of the data in the frame buffer and sets it back to the last state which the transceiver had before changing into transmit mode after the data is read out. This is done to avoid data corruption when `_recv(...)` is called to retrieve the buffer size and frame buffer protection is released.
|
@jia200x could this still go in? It somehow was missed during the release proceedures. |
|
(best practice advice for future release managers: remove |
|
oh yes, I missed this one :( I think we can still merge it though |
I will add this to the Release Manager draft |
|
we can follow #10757 and backport this as well |
This bug might lead to DoS, right? |
Yes, I mean we should backport #10575 and merge this one as well, before tagging a sub release. |
Ah, I see what you mean. Yes, if a layer on top is trying to drop a frame, it won't be released. Thus, there's potential DoS attacks. |
|
The patch of this PR is the same as #9509. I couldn't test to release a packet here but did several ping tests with gnrc_networking and it works as expected. |
This PR sets the tranceiver in PLL_ON state to avoid corruption of the
data in the frame buffer and sets it back to the last state which the
transceiver had before changing into transmit mode after the data is
read out. This is done to avoid data corruption when
_recv(...)iscalled to retrieve the buffer size and frame buffer protection is released.
see
#9509
#9509 (comment)