fix: null-check NodeDB pointers and harden RX path to prevent heap-pressure crashes - #11377
fix: null-check NodeDB pointers and harden RX path to prevent heap-pressure crashes#11377clawoneloke wants to merge 1 commit into
Conversation
…essure crashes
Three related fixes that address the T-Lora T3 reboot on HTTP connect
(root cause: heap exhaustion during config dump triggering null derefs
and pool exhaustion):
1. MeshService.cpp: Cache getMeshNode(mp->from) before dereferencing
has_user. Avoids two linear NodeDB scans per RX packet and closes
the TOCTOU window where a concurrent task could evict the node.
2. Router.cpp: Cache getMeshNode(p->from) and getMeshNode(p->to)
before dereferencing user.public_key.size in the PKI decode path.
Also closes TOCTOU and avoids duplicate linear scans.
3. RadioLibInterface.cpp:
- Fix randomByte() half-open range: random(0,255) never yields 255,
changed to random(0,256) per RadioLib semantics.
- Downgrade RADIOLIB_ERR_CRC_MISMATCH from LOG_ERROR to LOG_INFO
(routine in RF-congested areas, not an error).
- Move rxGood++ to always count CRC-valid OTA receptions before
short/from-null packet rejection.
- Add null-check after packetPool.allocZeroed() to prevent NULL
deref under pool exhaustion.
Fixes: meshtastic#10040
|
|
@clawoneloke, Welcome to Meshtastic!Thanks for opening your first pull request. We really appreciate it. We discuss work as a team in discord, please join us in the #firmware channel. Welcome to the team 😄 |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
3 participants
Summary
Three related fixes that address the T-Lora T3 reboot on HTTP connect reported in meshtastic/firmware#10040. Root cause: heap exhaustion during config dump triggers null derefs and packet pool exhaustion.
Changes
1.
src/mesh/MeshService.cpp— Null-checkgetMeshNode(mp->from)before dereferencingCache the NodeDB lookup in a local pointer before dereferencing
->has_userinhandleFromRadio(). This closes the TOCTOU window where a concurrent task could evict the node between the lookup and the dereference, and reduces two linear NodeDB scans per RX packet to one.Before:
After:
2.
src/mesh/Router.cpp— Cache NodeDB lookups in PKI decode pathCache
getMeshNode(p->from)andgetMeshNode(p->to)before dereferencing->user.public_key.size. Eliminates duplicate linear scans and closes the TOCTOU hazard.3.
src/mesh/RadioLibInterface.cpp— Four hardening fixesrandomBytes(): Fix half-open range —random(0, 255)can never produce byte value 255. Changed torandom(0, 256)per RadioLib semantics.RADIOLIB_ERR_CRC_MISMATCHfromLOG_ERRORtoLOG_INFO— CRC mismatches are routine in RF-congested areas and not an error condition.rxGoodplacement: MoverxGood++to always count CRC-valid OTA receptions before short/from-null packet rejection, so valid airtime is not silently lost from stats.packetPool.allocZeroed()to prevent NULL deref when heap pressure is high during config dumps.Testing
These fixes address the crash pattern observed in #10040:
Compiles successfully on ESP32 (T-Lora T3 target). Please test on SX126x devices with active mesh and phone connections.
Related