Skip to content

Fix unguarded pointer write in HAL_UART_ErrorCallback - #708

Open
jonwaterschoot wants to merge 1 commit into
electro-smith:masterfrom
Synthux-Academy:fix/uart-error-callback-null-deref
Open

Fix unguarded pointer write in HAL_UART_ErrorCallback#708
jonwaterschoot wants to merge 1 commit into
electro-smith:masterfrom
Synthux-Academy:fix/uart-error-callback-null-deref

Conversation

@jonwaterschoot

Copy link
Copy Markdown

MapInstanceToHandle() explicitly returns NULL for any instance not in its known list of 9 UART/USART peripherals. f7c63ae added an unconditional write through that pointer on every UART error (handle->listener_mode_ = false), with no null check.

Found on a board (TouchPlaited) that runs UART MIDI continuously alongside I2C (OLED, capacitive touch) and USB: a floating/idle MIDI input generating occasional UART framing noise caused the OLED to stop updating, touch pads to stop responding, and USB enumeration to fail entirely, while audio and switch/knob input kept working normally. Bisected the regression to this exact commit against a known-good older libDaisy snapshot; reverting just these two lines resolves all three symptoms on the affected hardware.

I haven't fully isolated the mechanism at the register level, it could be the null write itself for an unmapped instance, or the added per-interrupt cost under a high error rate starving other peripherals' interrupt servicing, but the fix is verified against the observed failure, and the missing null check is a real gap regardless of which it is.

MapInstanceToHandle() explicitly returns NULL for any instance not in
its known list of 9 UART/USART peripherals. f7c63ae added an
unconditional write through that pointer on every UART error
(handle->listener_mode_ = false), with no null check.

Found on hardware where a board runs UART MIDI continuously alongside
I2C (OLED, touch) and USB: a floating/idle MIDI input generating
occasional UART framing noise caused the OLED to stop updating,
touch pads to stop responding, and USB enumeration to fail entirely,
while audio and switch/knob input kept working normally. Bisected to
this exact commit; reverting just these two lines resolves all three
symptoms on the affected hardware. Root cause not fully isolated at
the register level (could be the null write itself for an unmapped
instance, or the added per-interrupt cost under a high error rate
starving other peripherals' interrupt servicing), but the fix is
verified against the observed failure.
@jonwaterschoot

Copy link
Copy Markdown
Author

Same as my other PR before this: I was using an LLM to help me make TouchPlaited a firmware for Simple Touch using the mpr121 sensor and after updating libDaisy this issue surfaced. Traced it back to this, however it might be purposefully implemented for another bug.
It made my OLED freeze and the USB midi connection fail. Hence this was the fix. Since this might be a personal experience and is not guaranteed by my own knowledge this may be closed or remade etc.
Sorry for any inconvenience - won't submit PR's directly like this again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant