Skip to content

mgmt/smp_uart: Fix TX fragment size and RX line handling - #3837

Merged
sjanc merged 5 commits into
apache:masterfrom
sjanc:smp_uart_fixes
Oct 26, 2026
Merged

sjanc merged 5 commits into
apache:masterfrom
sjanc:smp_uart_fixes

Conversation

@sjanc

@sjanc sjanc commented Oct 25, 2026

Copy link
Copy Markdown
Contributor

No description provided.

sjanc added 3 commits October 25, 2026 22:30
NUS_EV_TO_STATE() casted pointer to int, which failed to build with
-Werror=pointer-to-int-cast on 64-bit hosts, e.g. for native BSP.
Use CONTAINER_OF() instead.

Assisted-by: Claude:claude-opus-5-5
First fragment of a frame is prefixed with 2 bytes of frame length,
so only sizeof(tmp_buf) - 2 bytes of data fit in tmp_buf. The check
added the prefix length instead of subtracting it, so responses of 11
to 14 bytes, e.g. response to os reset request, were copied past the
end of tmp_buf on stack.

Assisted-by: Claude:claude-opus-5-5
Received line was handed over to the mgmt task in a single slot and
assert checked that previous line was already processed. Frames of a
packet longer than one line are sent back to back, so it was enough
for the mgmt task to be busy for a moment, e.g. when processing a
previous request, to hit the assert. Two newline characters sent
quickly were enough to trigger it on purpose.

Queue received lines and process all of them in mgmt task. Also
initialize the queue and the event callback before opening UART as
data may be received as soon as UART is opened.

Assisted-by: Claude:claude-opus-5-5
sjanc added 2 commits October 25, 2026 23:47
Frames were appended to partially received packet until its length
matched packet length declared in the first frame, which could be up
to 64 KB, pinning mbufs until msys pool was exhausted and no further
input could be received. Packet length was also read from the first
frame even if it was too short to contain it.

Drop packets longer than MTU or longer than their declared length.

Assisted-by: Claude:claude-opus-5-5
Characters were appended to received line until mbuf allocation
failed, draining msys pool. Lines longer than maximum frame length are
invalid, drop characters past it.

Assisted-by: Claude:claude-opus-5-5
@sjanc
sjanc merged commit 61a2add into apache:master Oct 26, 2026
21 of 22 checks passed
@sjanc
sjanc deleted the smp_uart_fixes branch October 26, 2026 12:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants