New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mbed-os-example-wifi hangs on ODIN-W2 #6003

Closed
juhaylinen opened this Issue Feb 2, 2018 · 13 comments

Comments

Projects
None yet
6 participants
@juhaylinen
Contributor

juhaylinen commented Feb 2, 2018

Description

  • Type: Bug
  • Priority: Critical

Bug

Target
UBLOX_EVK_ODIN_W2

Toolchain:
GCC_ARM|ARM|IAR

mbed-cli version:
1.2.2

mbed-os sha:
b8d2180

Expected behavior
mbed-os-example-wifi is run successfully

Actual behavior
mbed-os-example-wifi hangs and doesn't scan the network or connect to AP

Steps to reproduce
Compile mbed-os-example-wifi and try to run on u-blox Odin board

Bug analysis
It seems that PR #5630 breaks the WiFi connectivity

@juhaylinen

This comment has been minimized.

Contributor

juhaylinen commented Feb 6, 2018

Priority is now Critical

@0xc0170

This comment has been minimized.

Member

0xc0170 commented Feb 6, 2018

It seems that PR #5630 breaks the WiFi connectivity

Can you confirm that without this pull request, the example works?

@ARMmbed/team-ublox Please review

@juhaylinen

This comment has been minimized.

Contributor

juhaylinen commented Feb 6, 2018

Yes, If I revert the pull request, the example works.

@0xc0170

This comment has been minimized.

Member

0xc0170 commented Feb 6, 2018

cc @adustm Please review, relates to #5630

@adustm

This comment has been minimized.

Member

adustm commented Feb 6, 2018

Hello,
Can you clarify at which moment the mbed-os-example-wifi is using SHA1 / SHA256 or MD5 ?
I can't remember it.
Kind regards
Armelle

@juhaylinen

This comment has been minimized.

Contributor

juhaylinen commented Feb 6, 2018

Narrowed the issue down to MD5 calculation. My guess is that the binary driver (libublox-odin-w2-driver) uses MD5.

It is also used in this file https://github.com/ARMmbed/mbed-os/blob/master/features/FEATURE_LWIP/lwip-interface/lwip-sys/lwip_tcp_isn.c but the mbed-os-example-wifi hangs before the code is executed.

@andreaslarssonublox

This comment has been minimized.

Contributor

andreaslarssonublox commented Feb 8, 2018

Hi,
This will probably not work without a new driver since MD5 is used in the driver. I've compiled a new driver for test but it fails when the TCP communication starts.

I think I've located where it goes wrong. In the function lwip_hook_tcp_isn the MD5 context is created on the stack but there is no initialization of the struct and therefore bogus values(especially length field is wrong 0xd8) are used in lwip_md5_update resulting in stack overwrite.

@adustm Shouldn't lwip_md5_starts clear the whole struct or how is this supposed to work?

@adustm

This comment has been minimized.

Member

adustm commented Feb 8, 2018

Hello @andreaslarssonublox
Thanks for narrowing the issue. I was not aware the lwip files were using the md5 functions.

The md5_context is initialialized in the md5_init function.
I think you should use
lwip_md5_init before lwip_md5_start
and lwip_md5_free after lwip_md5_finish

@andresag01 or @hanno-arm , could you confirm that ? Shall md5_start initialize md5_context memory or shall md5_init be called here


?

Kind regards

@hanno-arm

This comment has been minimized.

Contributor

hanno-arm commented Feb 8, 2018

Hi,

@adustm is right: The usage of any context structure in Mbed TLS must be delimited by calls to the respective xxx_init and xxx_free functions. Specifically, the MD5 context in question must be initialized via lwip_md5_init and freed via lwip_md5_free before/after use with the actual digest calculating functions lwip_md5_{starts/update/finish}.

Kind regards,
Hanno

@juhaylinen

This comment has been minimized.

Contributor

juhaylinen commented Feb 19, 2018

Fixed in #6032

@teetak01

This comment has been minimized.

teetak01 commented Mar 20, 2018

@0xc0170 please open this ticket as it still impacts current release versions.

@0xc0170

This comment has been minimized.

Member

0xc0170 commented Mar 20, 2018

@0xc0170 please open this ticket as it still impacts current release versions.

Can you provide an update what versions are impacted, how, etc? As my understanding, 5.8 does not have this issue anymore.

@teetak01

This comment has been minimized.

teetak01 commented Mar 20, 2018

5.7.5->5.7.7

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment