Coverity reported potential issues with implicit signed/unsigned type
conversions and potential problems with this. Fix this, by casing the
byte-shifted data variable to uint64_t type explicitly.
Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
Coverity reported that assigning ret = 0 is pointless, as in any
scenario (loop continues or ends) the ret variable is overwritten
anyway, w/o using the assigned value. Therefore remove the needless
assignment.
Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
obj_inst_id should not be used directly to index the instance array, as
the instance ID is not tightly bound to the maximum instance count and
can exceed this value, causing out-of-bound access.
Therefore, perform some extra validation when choosing the array index
for the object instance to make sure we stay in the array bounds, or
return an error if there's no more room for more object instances, in a
similar way it's done for Security object.
Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
In case TCP connection is being closed from the TCP stack, due to for
instance retransmission timeout, the stack should also switch the TCP
state to CLOSED. Otherwise, there was a risk of dereferencing the TCP
context twice, for example if the application was in active socket
send(), and tried to reschedule data transmission.
Additionally, make sure that the TCP_CLOSED state handling is a no-op
state - otherwise, there is a risk that if packets keep incoming before
the application dereferences the TCP context on its side, TCP stack
will incorrectly dereference the context for the second time from
within due to current TCP_CLOSED state logic.
Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
As long as we do not have NVS support in TBS, the subscriptions shall be
removed once ACL is disconnected to avoid potential crash on
reconnection, as the subscription parameters might be not valid anymore.
Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
This fixes repeated attempt to bt_tbs_client_discover that failed
because srv_inst->current_inst was not cleared during previous discovery
process. The issue seen in case the GATT Read CCID returned an error.
The code has been factored out to separate helper function.
Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
This fixes missing guard access to GATT read parameters.
The code checks `busy` flag and returns an error in case there's ongoing
GATT Read operation already.
Fixes: #58425
Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
The port we are connecting to is stored in network byte order,
thus, we need to convert it to the CPU's byte order before logging
Signed-off-by: Mark Oude Elberink <mark@oude-elberink.de>
`local_addr` would only be initialized if `context->local->sin*_addr` was
non-null. However, since `context` is a fresh context object, `local_addr`
always remains at its initial value of `INADDR_ANY`, which is propagated to
the context by `net_context_bind()`.
By populating `local_addr` using the TCP endpoint, `getsockname()` now
returns the correct local address.
Signed-off-by: Armin Brauns <armin.brauns@embedded-solutions.at>
In order to support external IP stacks that might have Connection
ID support, the LwM2M engine should allow client to bypass default
behaviour.
New set_socketoptions() callback added into client context
that allows overriding all socket opetions. This is called
after a socket is opened, but before the connect() is
called. This cannot be combined with load_credentials() callback
on all platforms as for example nRF91 requires modem offline
when credentials are written. This would cause socket to be closed
as well.
Second change is that we allow fine tuning of what we do with
socket handle when QUEUE mode is enabled and engine enters idle
state.
First option would be to close the socket. That would cause
TLS Alert(Close Notify) to be send. This is a band choice if
LTE modem was already in PSM or eDRX power saving mode.
Second option would be to delay socket closing until we
are going to send LwM2M update. There TLS Alert is also send,
but most probably lost due to NAT mapping timed out. This
is a best choice for LTE modem with DTL session cache enabled.
Two new options are to keep socket open, and either stop listening
or just keep listening. Both of these options work fine when
we have DTLS Connection ID support.
Signed-off-by: Seppo Takalo <seppo.takalo@nordicsemi.no>
-- Implemented reporting of lost / missing SDUs for framed PDUs. This
should result in SDUs being released when only framed padding PDUs or
error PDUs are received.
-- Removed unused configuration params structure, storage and linked
APIs.
-- Reduced default logging level to INF instead of DBG.
-- Included debug logging messaged for framed consumption.
-- Removed separate latency_unframed and latency_framed and replaced
with a common sdu_sync_const as they are mutually exclusive for each
sink.
-- Restricted framed time stamp calculation only to situations where all
dependent information is available.
-- Corrected SDU sequence numbering to release starting at zero.
Signed-off-by: Nirosharn Amarasinghe <niag@demant.com>
Based on interpretation of Clarification Errata ES-22876 Request for
Clarification - Recombination actions when only padding unframed PDUs
are received, it was decided that an SDU should be released as "Missing"
when only padding PDUs are received for any SDU.
- https://bluetooth.atlassian.net/browse/ES-22876
This change will also assist streaming in the Common Central design
where the central was found to send only padding PDUs before streaming
starts.
Signed-off-by: Nirosharn Amarasinghe <niag@demant.com>
In case lwm2m_socket_start() internal error, it should only do cleanup
on the socket, i. e. call lwm2m_socket_close(), not lwm2m_engine_stop().
The latter resets the entire lwm2m_context, which results in removal of
active observations.
This should not be done, as it collides with the RD client logic, where
connection resumption may skip the full registration phase, in result
not notifying the server that it should restart the observations.
At the same time, the RD client should clean the lwm2m_context when it's
done trying to update the registration and proceeds with regular
registration/bootstrap in the network error handler. In that case, only
the socket was closed, so the lwm2m_context needs to be reset
separately.
Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
If the num_ase == 0xff then it is a special case that needs to be
handled like if num_ase == 0x01.
If there is an error with ase_id = 0x00 then the error cannot
be translated to a specific stream, so the callbacks may now get
NULL for the stream object.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
When CCC or CF store on write is disabled and the other one is enabled,
leading to the delayed store being enabled. This cause the value of the
corresponding `n` selected option to not be stored at all.
To fix this, the checks to know if we need to store the CCC or the CF,
happening at the disconnection, are now ensuring that the CCC or the CF
are stored even if the one of them does not enable store on write.
Signed-off-by: Théo Battrel <theo.battrel@nordicsemi.no>
Remove the lower check (BT_BAP_BASS_OP_SCAN_STOP) in
BT_BAP_BASS_VALID_OPCODE as it is always used on unsigned
variables, so no point in check if it is lower than 0.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Add check for the index in the function itself, as well as where
we call it internally, to ensure that we do not attempt to access
invalid indexes of broadcast_assistant.recv_state_handles.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
This fixes missing `CONFIG_*` prefix.
The `BT_HAS_PRESET_CONTROL_POINT_NOTIFIABLE` option is already guarded
with `BT_HAS_PRESET_SUPPORT`, so it has been removed from `depends on`
condition.
Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
This fixes regression causing compilation errors seen when the
code is built without preset support (BT_HAS_PRESET_COUNT = 0).
Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
nvs_sector_close has not been initializing nvs_ate.part, before
writing it to flash.
Fixes#58699
Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
Added assert when looking up the next instance, as the caller of this
function should ensure that the index is correct before calling
discover_next_instance.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
If the minimal value of an IN_RANGE is 0, then it is
a useless check, and the cases have been modified to
not use IN_RANGE. This also fixes some coverity issues.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The check was a && but should have been an ||. Fixed by moving
the check to a new if statement.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
When notify_app is called for BT_TBS_CALL_OPCODE_TERMINATE
we did a lookup on the call index, but never did a NULL check
before dereferecing it.
This does not fix the issue that the instance will always
be NULL in this case, as we have terminated the call so
we cannot possibly look up the call afterwards.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The friendly copy always assumed that the friendly name could
fit in memory, which could cause overflows. Fixed by using
utf8_lcpy as that not only ensures that the copy is truncated
to fit in memory, but also ensures that it is null terminated
and truncated in a way that supports multi-byte UTF8 characters.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The previous implementation would read from `addr->val[0]` before it was
initialized if the input string started with a colon ':'.
Signed-off-by: Aleksander Wasaznik <aleksander.wasaznik@nordicsemi.no>
If offset is only 32-bit, then it can never be > UINT32_MAX,
so added another conditional that only if the type (off_t) is
larger than 32-bit, we perform the maximum value check.
off_t is not a standard type and thus the size of it is poorly
defined, and are just defined as a signed integer type.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The check compared the levels against < BT_IAS_ALERT_LVL_NO_ALERT
which of course does not make sense given than the lvl_u8 is an
unsigned value that can never be < BT_IAS_ALERT_LVL_NO_ALERT.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Use unsigned long long and shell_strtoull to get the ID of
OTS objects, as unsigned long may not be able to store all 48
bits.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Add a shell_strtoull function that works similar to
shell_strtoul except that it calls strtoull instead
of strtoul.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Ensure that scan_filter.addr is NULL terminated by only copying
the sizeof the buffer -1 and then always setting the last byte to
\0.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The number of buffer provided was verified in the final else block of a
long validation sequence. It would never be executed though, as one of
the conditions before would always evaluate to true.
As the number of buffers provided verification appears to be significant
in this case, as the buffers are referenced during other validations,
move this check at the beginning of the sequence instead. This also
eliminates the dead-code problem.
Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
Use if-else-endif construction to avoid dead code.
Coverity-CID: 316484, GitHub issue #58539
Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>
Just drop PENDING_RESET flag without checking it.
Coverity-CID: 316394, GitHub issue #58530
Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>
Use ULL suffix to promote the type of the shift operand to uint64_t to
avoid undefined behavior when block_size_log is 32.
Coverity-CID: 316387, GitHub issue #58528
Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>
Coverity is complaining:
CID 316017: Control flow issues (NO_EFFECT)
>>> This less-than-zero comparison of an unsigned value is never true.
148 for (size_t i = 0; i < ARRAY_SIZE(substate_lock_t); i++) {
This is a false positive but we can still optimize the code and making
coverity happy by simply avoiding compiling the offending code when no
power states are defined into the DT.
Signed-off-by: Carlo Caione <ccaione@baylibre.com>
In places where we verify that the value of the long
variable does not exceed the limits of int32_t, we do
actually not need to compare the values if the two
types are the same size, which is often the case for
32-bit systems.
This fixes a variety of coverity reported issues.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
When copying the address in cmd_scan_filter_set_addr we now
use strncpy to not copy more bytes than what fits. This
should already have been fixed with a check earlier in the
function, but coverity still complains.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
For IEEE 802.15.4 compliance, the NET_L2_IEEE802154_ACK_REPLY option must
automatically be active if the radio driver does not AUTOACK and inactive
otherwise. No user interaction is required.
Future changes will deprecate this option and replace it by a standard
compliant automatic mechanism.
Signed-off-by: Florian Grandel <fgrandel@code-for-humans.de>
