Skip to content

Commit 9e2103f

Browse files
mhightower83mhightower83
authored
Patch eap.o memory leak (#8566)
* Patch eap.o memory leak WiFi Enterprise option can leak up to 3 allocations per connect/disconnect cycle: anonymous Identity, password, and some unidentified allocation. This solution patches eap.o from libwpa2 to call a special 2 part wrapper instead of vPortFree for cleanup. Corrected typos and adjusted tabs in script. Added script eval_fix_sdks.sh to aid in evaluating similarity between patch sections of .o files being patched across different SDKs. * Add some dev debug code and improve comments * Patch eap.o memory leak WiFi Enterprise option can leak up to 3 allocations per connect/disconnect cycle: anonymous Identity, password, and some unidentified allocation. This solution patches eap.o from libwpa2 to call a special 2 part wrapper instead of vPortFree for cleanup. Corrected typos and adjusted tabs in script. Added script eval_fix_sdks.sh to aid in evaluating similarity between patch sections of .o files being patched across different SDKs. * Add some dev debug code and improve comments
1 parent 5f2af19 commit 9e2103f

File tree

12 files changed

+317
-5
lines changed

12 files changed

+317
-5
lines changed

Diff for: ‎cores/esp8266/coredecls.h

+1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ void esp_schedule();
2121
void esp_yield();
2222
void tune_timeshift64 (uint64_t now_us);
2323
void disable_extra4k_at_link_time (void) __attribute__((noinline));
24+
void enable_wifi_enterprise_patch(void) __attribute__((noinline));
2425
bool sntp_set_timezone_in_seconds(int32_t timezone);
2526
void __disableWiFiAtBootTime (void) __attribute__((noinline));
2627
void __real_system_restart_local() __attribute__((noreturn));

Diff for: ‎cores/esp8266/heap.cpp

+7-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,13 @@
55

66
#include <stdlib.h>
77
#include "umm_malloc/umm_malloc.h"
8-
extern "C" size_t umm_umul_sat(const size_t a, const size_t b);;
8+
extern "C" size_t umm_umul_sat(const size_t a, const size_t b);
9+
10+
// z2EapFree: See wpa2_eap_patch.cpp for details
11+
extern "C" void z2EapFree(void *ptr, const char* file, int line) __attribute__((weak, alias("vPortFree"), nothrow));
12+
// I don't understand all the compiler noise around this alias.
13+
// Adding "__attribute__ ((nothrow))" seems to resolve the issue.
14+
// This may be relevant: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81824
915

1016
// Need FORCE_ALWAYS_INLINE to put HeapSelect class constructor/deconstructor in IRAM
1117
#define FORCE_ALWAYS_INLINE_HEAP_SELECT

Diff for: ‎cores/esp8266/wpa2_eap_patch.cpp

+157
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
/*
2+
* To implement this patch, the SDK module `eap.o` from archive `libwpa2.a` must
3+
* be patched to call `z2EapFree` instead of `vPortFree`. This limits extending
4+
* the execution time of vPortFree to that module only. Not impacting other
5+
* modules.
6+
*
7+
*/
8+
9+
#include <string.h>
10+
#include <ets_sys.h>
11+
#include <pgmspace.h>
12+
#include "coredecls.h"
13+
14+
#ifdef DEBUG_WPA2_EAP_PATCH
15+
#include "esp8266_undocumented.h"
16+
#define DEBUG_PRINTF ets_uart_printf
17+
#else
18+
#define DEBUG_PRINTF(...)
19+
#endif
20+
21+
extern "C" {
22+
23+
// extern "C" void z2EapFree(void *ptr, const char* file, int line) __attribute__((weak, alias("vPortFree")));
24+
25+
/*
26+
* Limited 2-part wrapper for vPortFree calls made in SDK module `eap.o` from
27+
* archive `libwpa2.a`.
28+
*
29+
* vPortFree calls from eap.o are monitored for calls from line 799. This is
30+
* the location of the memory leak. At entry register a12 contains the structure
31+
* address which has the addresses of the allocations that will be leaked.
32+
*
33+
* Part 1 of this wrapper, z2EapFree, appends the value of register a12 as a
34+
* 4th argument to part2 of this wrapper, patch_wpa2_eap_vPortFree_a12(). Which
35+
* in turn checks and frees the additional allocations, that would have been
36+
* lost.
37+
*
38+
* extern "C" z2EapFree(void*);
39+
*/
40+
41+
/*
42+
* Part 1 of Limited vPortFree Wrapper
43+
*/
44+
asm(
45+
// ".section .iram.text.z2EapFree,\"ax\",@progbits\n\t"
46+
// Since all the possible callers in eap.o are in sections starting with
47+
// .text and not .iram.text we should be safe putting these wrappers in .text.
48+
".section .text.z2EapFree,\"ax\",@progbits\n\t"
49+
".literal_position\n\t"
50+
".literal .patch_wpa2_eap_vPortFree_a12, patch_wpa2_eap_vPortFree_a12\n\t"
51+
".align 4\n\t"
52+
".global z2EapFree\n\t"
53+
".type z2EapFree, @function\n\t"
54+
"\n"
55+
"z2EapFree:\n\t"
56+
"addi a1, a1, -16\n\t"
57+
"s32i a0, a1, 0\n\t"
58+
"mov a5, a12\n\t"
59+
"l32r a0, .patch_wpa2_eap_vPortFree_a12\n\t"
60+
"callx0 a0\n\t"
61+
"l32i a0, a1, 0\n\t"
62+
"addi a1, a1, 16\n\t"
63+
"ret\n\t"
64+
".size z2EapFree, .-z2EapFree\n\t"
65+
);
66+
67+
/*
68+
* While some insight can be gained from the ESP32 repo for this structure.
69+
* It does not match exactly. This alternate structure focuses on correct offset
70+
* rather than trying to exactly reconstruct the original labels.
71+
* These offset were found in libwpa2.a:eap.o .text.eap_peer_config_init
72+
*/
73+
struct StateMachine { // size 200 bytes
74+
void* beforeConfig[16];
75+
void* config[26];
76+
// 0 - s32i a2, a12, 64 // username / Identity
77+
// 1 - s32i a2, a12, 68 // length
78+
// 2 - s32i a2, a12, 72 // anonymous Identity
79+
// 3 - s32i a2, a12, 76
80+
// 4 - s32i a2, a12, 80 // password
81+
// 5 - s32i a2, a12, 84
82+
//
83+
// "new password" - From wifi_station_set_enterprise_new_password(), we see
84+
// global saved value .bss+32 and .bss+36 which are later used to populate
85+
// ".config" in eap_peer_config_init(). I do not have an environment to
86+
// exercise this parameter. In my tests, the "new password" element in the
87+
// ".config" is never initialized. At the moment, I don't see any code that
88+
// would free the allocation.
89+
// allocated via pvPortZalloc from line 0x30f, 783
90+
// 21 - s32i a2, a12, 148 // new password
91+
// 22 - s32i a2, a12, 152
92+
93+
void* afterConfig[8];
94+
};
95+
96+
/*
97+
* Part 2 of Limited vPortFree Wrapper
98+
*
99+
* Presently, all SDKs have the same memory leaks in the same module at the
100+
* same line.
101+
*/
102+
void patch_wpa2_eap_vPortFree_a12(void *ptr, const char* file, int line, void* a12) {
103+
if (799 == line) {
104+
// This caller is eap_peer_config_deinit()
105+
struct StateMachine* sm = (struct StateMachine*)a12;
106+
if (ptr == sm->config[0]) {
107+
// Fix leaky frunction - eap.o only frees one out of 4 config items
108+
// finish the other 3 first
109+
vPortFree(sm->config[2], file, line);
110+
vPortFree(sm->config[4], file, line);
111+
vPortFree(sm->config[21], file, line);
112+
// ptr is sm->config[0], let fall through handle it
113+
}
114+
#ifdef DEBUG_WPA2_EAP_PATCH
115+
DEBUG_PRINTF("\nz2EapFree/vPortFree patch struct StateMachine * = %8p\n", a12);
116+
DEBUG_PRINTF(" config[0] vPortFree(%8p, file, line);\n", ptr);
117+
DEBUG_PRINTF(" config[2] vPortFree(%8p, file, line);\n", sm->config[2]);
118+
DEBUG_PRINTF(" config[4] vPortFree(%8p, file, line);\n", sm->config[4]);
119+
DEBUG_PRINTF(" config[21] vPortFree(%8p, file, line);\n", sm->config[21]);
120+
if (a12) {
121+
void** pw = (void**)a12;
122+
DEBUG_PRINTF("\nhexdump struct StateMachine:\n");
123+
for (size_t i=0; i<200/4; i+=4) {
124+
DEBUG_PRINTF("%03u: %8p %8p %8p %8p\n", i*4, pw[i], pw[i+1], pw[i+2], pw[i+3]);
125+
}
126+
}
127+
#endif
128+
}
129+
#if 0
130+
// This is not needed because the call was NO-OPed in the library. This code
131+
// snippit is just to show how a future memory free issue might be resolved.
132+
else if (672 == line) {
133+
// This caller is wpa2_sm_rx_eapol()
134+
// 1st of a double free
135+
// let the 2nd free handle it.
136+
return;
137+
}
138+
#endif
139+
vPortFree(ptr, file, line);
140+
}
141+
142+
};
143+
144+
/*
145+
* This will minimize code space for non-wifi enterprise sketches which do not
146+
* need the patch and disable_extra4k_at_link_time().
147+
*/
148+
void enable_wifi_enterprise_patch(void) {
149+
/*
150+
* Calling this from setup or anywhere ensures that the patch code is
151+
* included in the build.
152+
*
153+
* Also, WiFi Enterprise uses a lot of system stack space and may crash
154+
* unless we:
155+
*/
156+
disable_extra4k_at_link_time();
157+
}

Diff for: ‎tools/sdk/lib/NONOSDK221/libwpa2.a

0 Bytes
Binary file not shown.

Diff for: ‎tools/sdk/lib/NONOSDK22x_190313/libwpa2.a

0 Bytes
Binary file not shown.

Diff for: ‎tools/sdk/lib/NONOSDK22x_190703/libwpa2.a

0 Bytes
Binary file not shown.

Diff for: ‎tools/sdk/lib/NONOSDK22x_191024/libwpa2.a

0 Bytes
Binary file not shown.

Diff for: ‎tools/sdk/lib/NONOSDK22x_191105/libwpa2.a

0 Bytes
Binary file not shown.

Diff for: ‎tools/sdk/lib/NONOSDK22x_191122/libwpa2.a

0 Bytes
Binary file not shown.

Diff for: ‎tools/sdk/lib/NONOSDK3V0/libwpa2.a

0 Bytes
Binary file not shown.

Diff for: ‎tools/sdk/lib/eval_fix_sdks.sh

+117
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
#!/bin/bash
2+
# set -e
3+
4+
add_path_ifexist() {
5+
if [[ -d $1 ]]; then
6+
export PATH=$( realpath $1 ):$PATH
7+
return 0
8+
fi
9+
return 1
10+
}
11+
12+
if ! which xtensa-lx106-elf-ar | grep "tools/xtensa-lx106-elf/bin" >>/dev/null; then
13+
add_path_ifexist "../../../xtensa-lx106-elf/bin" || add_path_ifexist "../../xtensa-lx106-elf/bin"
14+
fi
15+
16+
help_msg() {
17+
cat <<EOF
18+
Try:
19+
eval_fix_sdks.sh --analyze
20+
or
21+
eval_fix_sdks.sh --patch
22+
23+
EOF
24+
}
25+
26+
list_sdks() {
27+
cat <<EOF
28+
NONOSDK22x_190313
29+
NONOSDK22x_190703
30+
NONOSDK22x_191024
31+
NONOSDK22x_191105
32+
NONOSDK22x_191122
33+
NONOSDK221
34+
NONOSDK3V0
35+
EOF
36+
}
37+
38+
remove_ifexist() {
39+
[[ -f $1 ]] && rm $1
40+
}
41+
42+
cleanup() {
43+
remove_ifexist old.txt
44+
remove_ifexist old2.txt
45+
remove_ifexist new.txt
46+
for sdk in `list_sdks`; do
47+
remove_ifexist $sdk/eap.o
48+
done
49+
}
50+
51+
unasm() {
52+
xtensa-lx106-elf-objdump -d $*
53+
}
54+
55+
analyze() {
56+
cleanup
57+
58+
for sdk in `list_sdks`; do
59+
pushd $sdk
60+
xtensa-lx106-elf-ar x libwpa2.a eap.o
61+
popd
62+
done
63+
echo ""
64+
65+
find . -name eap.o -exec md5sum {} \; | sort
66+
echo ""
67+
68+
unset prev_sdk
69+
for sdk in `list_sdks`; do
70+
unasm -j ".text.eap_peer_config_deinit" ${sdk}/eap.o >new.txt
71+
if [[ -f old.txt ]]; then
72+
echo "eap_peer_config_deinit: diff $prev_sdk $sdk"
73+
diff old.txt new.txt
74+
echo ""
75+
fi
76+
mv new.txt old.txt
77+
prev_sdk=${sdk}
78+
done
79+
80+
unset prev_sdk
81+
for sdk in `list_sdks`; do
82+
unasm -j ".text.wpa2_sm_rx_eapol" ${sdk}/eap.o >new.txt
83+
if [[ -f old2.txt ]]; then
84+
echo "wpa2_sm_rx_eapol: diff $prev_sdk $sdk"
85+
diff old2.txt new.txt
86+
echo ""
87+
fi
88+
mv new.txt old2.txt
89+
prev_sdk=${sdk}
90+
done
91+
92+
# Find offsets for patching vPortFree with z2EapFree
93+
for sdk in `list_sdks`; do
94+
echo -en "\n${sdk}/eap.o:\n "
95+
grep --byte-offset --only-matching --text vPortFree ${sdk}/eap.o
96+
done
97+
98+
cleanup
99+
}
100+
101+
102+
patch_all() {
103+
for sdk in `list_sdks`; do
104+
pushd $sdk
105+
../fix_sdk_libs.sh
106+
popd
107+
done
108+
}
109+
110+
if [[ "${1}" == "--analyze" ]]; then
111+
analyze
112+
elif [[ "${1}" == "--patch" ]]; then
113+
patch_all
114+
else
115+
help_msg
116+
fi
117+
exit 0

Diff for: ‎tools/sdk/lib/fix_sdk_libs.sh

+35-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,19 @@
11
#!/bin/bash
22
set -e
33

4-
export PATH=../../../xtensa-lx106-elf/bin:$PATH
4+
add_path_ifexist() {
5+
if [[ -d $1 ]]; then
6+
export PATH=$( realpath $1 ):$PATH
7+
return 0
8+
fi
9+
return 1
10+
}
11+
12+
if ! which xtensa-lx106-elf-ar | grep "tools/xtensa-lx106-elf/bin" >>/dev/null; then
13+
add_path_ifexist "../../../xtensa-lx106-elf/bin" || add_path_ifexist "../../xtensa-lx106-elf/bin"
14+
fi
15+
WORK_SPACE=${PWD}
16+
517
VERSION=$(basename ${PWD})
618

719
addSymbol_system_func1() {
@@ -18,14 +30,30 @@ patchFile() {
1830
EXPECTED=$4
1931
REPLACEWITH=$5
2032
if [[ "$(dd if=$FILE bs=1 count=$LENGTH skip=$ADDRESS status=none | base64 -w0)" = "$EXPECTED" ]]; then
21-
echo "Patching $1..."
33+
echo "Patching $VERSION $1 ..."
2234
echo $5 | base64 -d | dd of=$FILE bs=1 count=$LENGTH seek=$ADDRESS conv=notrunc
2335
elif ! [[ "$(dd if=$FILE bs=1 count=$LENGTH skip=$ADDRESS status=none | base64 -w0)" = "$REPLACEWITH" ]]; then
2436
echo "PATCH FAILED!"
25-
exit 0
37+
echo "dd if=$FILE bs=1 count=$LENGTH skip=$ADDRESS status=none | base64 -w0"
38+
dd if=$FILE bs=1 count=$LENGTH skip=$ADDRESS status=none | hexdump -C
39+
dd if=$FILE bs=1 count=$LENGTH skip=$ADDRESS status=none | base64 -w0
40+
echo ""
41+
exit 1
2642
fi
2743
}
2844

45+
# # xtensa-lx106-elf-ar x libwpa2.a eap.o
46+
if [[ "--shell" == "$1" ]]; then
47+
# need to poke around a bit
48+
bash --rcfile <(echo ". ~/.bashrc; cd ${WORK_SPACE}")
49+
exit 0
50+
fi
51+
52+
if [[ ! -f libmain.a ]]; then
53+
echo -e "\n\n*** Archive libmain.a is missing ***\n\n"
54+
exit 1
55+
fi
56+
2957
# Remove mem_manager.o from libmain.a to use custom heap implementation,
3058
# and time.o to fix redefinition of time-related functions:
3159
xtensa-lx106-elf-ar d libmain.a mem_manager.o
@@ -44,15 +72,19 @@ xtensa-lx106-elf-objcopy --redefine-sym hostname=wifi_station_hostname eagle_lwi
4472
xtensa-lx106-elf-objcopy --redefine-sym default_hostname=wifi_station_default_hostname user_interface.o
4573
xtensa-lx106-elf-objcopy --redefine-sym default_hostname=wifi_station_default_hostname eagle_lwip_if.o
4674

75+
4776
if [[ ${VERSION} == "NONOSDK221" ]]; then
4877
addSymbol_system_func1 "0x60"
4978
patchFile "eap.o" "3055" "2" "wAA=" "8CA=" # WPA2-Enterprise patch which replaces a double-free with nop, see #8082
79+
patchFile "eap.o" "26352" "9" "dlBvcnRGcmVl" "ejJFYXBGcmVl" # special vPortFree to recover leaked memory
5080
elif [[ ${VERSION} == "NONOSDK22x"* ]]; then
5181
addSymbol_system_func1 "0x54"
5282
patchFile "eap.o" "3059" "2" "wAA=" "8CA=" # WPA2-Enterprise patch which replaces a double-free with nop, see #8082
83+
patchFile "eap.o" "26356" "9" "dlBvcnRGcmVl" "ejJFYXBGcmVl" # special vPortFree to recover leaked memory
5384
elif [[ ${VERSION} == "NONOSDK3"* ]]; then
5485
addSymbol_system_func1 "0x60"
5586
patchFile "eap.o" "3059" "2" "wAA=" "8CA=" # WPA2-Enterprise patch which replaces a double-free with nop, see #8082
87+
patchFile "eap.o" "26356" "9" "dlBvcnRGcmVl" "ejJFYXBGcmVl" # special vPortFree to recover leaked memory
5688
else
5789
echo "WARN: Unknown address for system_func1() called by system_restart_local()"
5890
fi
@@ -64,4 +96,3 @@ if [[ $(sha256sum user_interface.o | awk '{print $1}') != $uics || $(sha256sum e
6496
xtensa-lx106-elf-ar r libmain.a eagle_lwip_if.o user_interface.o
6597
fi
6698
rm -f eagle_lwip_if.o user_interface.o eap.o
67-

0 commit comments

Comments
 (0)