wiseconnect-wifi-bt-sdk icon indicating copy to clipboard operation
wiseconnect-wifi-bt-sdk copied to clipboard

Bug in rsi_ftp_file_write_content() causing stack corruption and deadlock

Open adam-durridge opened this issue 5 months ago • 0 comments

Sending data to an FTP server using multiple calls to rsi_ftp_file_write_content() can cause a serious bug to occur.

It can result in stack corruption (how I found it) and also gets the driver task in an incorrect state causing other Wi-Fi issues like lock ups until timeout.

It is due to how this SAPI call does not generate a response (RX Event) until the last chunk is sent. This https://github.com/SiliconLabs/wiseconnect-wifi-bt-sdk/blob/c95f05486ca38f9a365be5c18161339067b6a36b/sapi/network/protocols/rsi_ftp.c#L506-L510 sets that expected response.

The problem is that on the last chunk, even though this block does not execute due to end_of_file being set, rsi_driver_cb->wlan_cb->expected_response is still equal to RSI_WLAN_RSP_ASYNCHRONOUS from the previous call.

This causes a wait for semaphore instruction to be skipped, https://github.com/SiliconLabs/wiseconnect-wifi-bt-sdk/blob/c95f05486ca38f9a365be5c18161339067b6a36b/sapi/network/protocols/rsi_ftp.c#L524-L528 which causes the wait/post flow of the driver to get out of whack and can produce some nasty effects. In my case a subsequent SAPI call was returning early instead of waiting and when the RX event it should have been waiting on was processed, it filled a buffer that had gone out of scope.

I fixed this one by adding an else clause: else { rsi_driver_cb->wlan_cb->expected_response = RSI_WLAN_RSP_FTP; } I'm not positive this is the appropriate response to use, but it seems to work.

adam-durridge avatar Jan 21 '24 02:01 adam-durridge