SymbX/ModemManager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,564 Commits 2 Branches 0 Tags
2b1aaca4a0f729f8a54f162ff9dc299c82162bed
Commit Graph
9564 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Aleksander Morgado 2b1aaca4a0 ifaces: fix UAFs in signal handlers when hot-unplugging 
Use g_signal_connect_object() to connect to child list/object signals
in the 3GPP, Messaging, Voice, and Cell Broadcast interfaces.

Passing the raw D-Bus skeleton pointer as user_data to these signals
can lead to a Use-After-Free if the skeleton is disposed of (e.g. on
hot-unplug) while the parent object or child list survives. By using
g_signal_connect_object(), the signal handlers are automatically
disconnected when the D-Bus skeleton is destroyed.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1068

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 15:00:07 +02:00
Aleksander Morgado 0280bbae3b time: fix GSource leak and UAF in timezone poll 
Introduce a timezone poll session ID to validate timezone load
results. This ensures that when a pending timezone load completes, we
discard the result if a new poll session has been started (e.g. due to
registration state changes) or if polling has been stopped.

This prevents leaking GSource timeout sources and a subsequent
Use-After-Free if the modem is hot-unplugged while a poll is pending.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1067

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 15:00:07 +02:00
Aleksander Morgado 691bb4286d Merge request !1464 from 'aleksander/vreports' 
Sanitize user inputs

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1464
 2026-07-10 14:35:08 +02:00
Aleksander Morgado 6b3682ed65 voice: validate outgoing and deflect call numbers 
Validate the number parameter in Voice.CreateCall and Call.Deflect
D-Bus methods to ensure they do not contain control characters or
semicolons. This prevents AT command injection when the number is
later spliced into ATD or +CTFR commands.

Introduce a common helper mm_utils_is_valid_dial_number() to validate
dial numbers, and add unit tests for it.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1067

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 13:43:48 +02:00
Aleksander Morgado 3291e7dd1c sim: validate preferred networks operator codes 
Validate preferred network operator codes in the SIM D-Bus interface
handler to ensure they are numeric. This prevents injecting AT
command delimiters (like CR) into this field, which is later spliced
into AT commands (+CPOL).

This change also plugs the network list leak, that was a problem on
its own.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1065

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 13:43:48 +02:00
Aleksander Morgado 50202ad76a sim: validate PIN and PUK codes 
Validate PIN and PUK codes in the SIM D-Bus interface handlers to
ensure they are numeric. This prevents injecting AT command
delimiters (like CR) into these fields, which are later spliced
into AT commands (+CPWD, +CLCK, +CPIN).

Introduce a common helper mm_utils_is_numeric() to check if a string
contains only digits, and add unit tests for it.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1065

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 13:43:48 +02:00
Aleksander Morgado dd54145d71 ussd: quote USSD command to prevent AT injection 
When sending an unencoded USSD command, the user-supplied string was
spliced directly into the +CUSD AT command. If the string contained
CR or semicolons, it could lead to AT command injection.

Use mm_at_quote_string() to properly quote and escape the USSD
command before sending it.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1064

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 13:43:48 +02:00
Aleksander Morgado a39d46c637 location: validate SUPL host as FQDN or IP 
When parsing a SUPL address, if the host is not a valid IPv4 address,
validate it as a FQDN (allowing only alphanumeric characters, dots,
and hyphens). This prevents injecting AT command delimiters (like CR
or semicolon) into the host string, which is later spliced into
modem-specific AT commands (+XLCSSLP).

Introduce a common helper mm_utils_is_valid_fqdn() to validate FQDNs,
and add unit tests for it.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1063

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 13:43:48 +02:00
Aleksander Morgado 1ee3a443b1 sms: sanitize decoded alphanumeric SMS addresses 
Alphanumeric SMS addresses decoded from GSM-7 could contain control
characters (like CR/LF), which could lead to AT command injection
if the address is later spliced into an AT+CMGS command during
stored SMS send fallback.

Sanitize the decoded address by removing all control characters.

Introduce a common helper mm_utils_remove_control_characters() to
remove control characters from a string in-place, and add unit
tests for it.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1062

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 13:43:48 +02:00
Dan Williams 7088f5eaab Merge request !1457 from 'feat/update-man-mmcli' 
man,mmcli: add information about 'any' modem index  and --location-monitor

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1457
 2026-07-09 16:11:14 -05:00
Andrey Skvortsov 30b76ac3e2 man,mmcli: add description for --location-monitor 
Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
 2026-07-08 23:09:23 -05:00
Andrey Skvortsov 6bdee3cc68 man,mmcli: add information about 'any' modem index for mmcli 
It's possible to use special name 'any' as a modem index. It's
especially useful if system has only single modem.

Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
 2026-07-08 23:09:23 -05:00
Dan Williams d776ea38d2 Merge request !1458 from 'feat/use-any-in-man-mmcli' 
man,mmcli: use '-m any' instead of '-m 0' in examples

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1458
 2026-07-08 22:24:34 -05:00
Andrey Skvortsov 913f05e0b4 man,mmcli: use '-m any' instead of '-m 0' in examples 
Most users have only single modem. Commands with '-m any' will work
even if modem gets new index, because it's restarted or is replugged.

Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
 2026-07-08 22:22:18 -05:00
Dan Williams cc69ce8aaf Merge request !1444 from 'main' 
po: add Serbian and Serbian Latin translations

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1444
 2026-07-08 22:11:44 -05:00
Марко М. Костић (Marko M. Kostić) 2c3e8aeee0 po: add Serbian and Serbian Latin translations 
Signed-off-by: Marko Kostic <marko.m.kostic@gmail.com>
 2026-07-08 22:04:01 -05:00
Dan Williams 2b2560c567 Merge request !1462 from 'upd-pt_BR' 
po: update Brazilian Portuguese translation

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1462
 2026-07-08 22:01:25 -05:00
Rafael Fontenelle 0fbb9d05d2 po: update Brazilian Portuguese translation 
Signed-off-by: Rafael Fontenelle <rafaelff@gnome.org>
 2026-07-08 21:59:02 -05:00
Dan Williams 98777e693f Merge request !1461 from 'dp/fix-me310g1-bnd' 
ME910G1 and ME310M1 bands support and fixes

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1461
 2026-07-07 11:11:51 -05:00
Daniele Palmas 97c24d68e2 telit: add support for ME310M1 
ME310M1 supports band format as ME910G1.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
 2026-07-07 10:55:13 -05:00
Daniele Palmas 3ca0cba220 telit: add ME910G1 to models 
ME910G1 supports decimal format for 4G bands and has also an empty
tdscdma slot between 4G and 4G extended bands commands/responses.

Change shared code and helpers to deal with these differences.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
 2026-07-07 10:55:13 -05:00
Daniele Palmas 846048caa5 telit: fix band setting function to properly support multi-tech modems 
The assumption that if a modem supports a given access tech, the band
settings for that specific tech should be always given is wrong for
4g, since the 4g bands can be disabled setting the value to 0 in
multi-tech modems like ME310M1.

For example, a 3g + 4g modem could have a setting in which all
the 4g bands are unset and only 3g bands are there: this scenario is
not supported by the current code, but it's legitimate.

Remove this limitation and adapt the code to support bands setting
for multi-tech modems.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
 2026-07-07 10:55:13 -05:00
Daniele Palmas 069212e43e telit: add suffix HEX to 4G extended bands regex macro name 
In preparation to support regex for 4G extended bands decimal values.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
 2026-07-07 10:55:13 -05:00
Daniele Palmas e292401beb telit: tests: fix LN920 current bands configuration 
Fix LN920 current bands test configuration by setting
modem_has_hex_format_4g_bands to TRUE.

The current wrong setting does not cause the test failure since the modem
supports also extended settings and function telit_get_ext_4g_mm_bands
considers both standard and extended bands as hex without checking
the flag, since decimal format for extended bands is not supported.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
 2026-07-07 10:55:13 -05:00
Dan Williams 545b183934 Merge request !1467 from 'rm520-sahara-firehose' 
quectel: add RM520N Sahara/Firehose support

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1467
 2026-07-07 10:50:42 -05:00
Lukas Voegl 3dbdc0704d quectel: add RM520N Sahara/Firehose support 
Signed-off-by: Lukas Voegl <lvoegl@tdt.de>
 2026-07-03 14:12:48 +02:00
Dan Williams fcc9d19f5e Merge request !1424 from 'fix/multiline-gsv' 
location-gps-nmea: add complete sequence to traces at once

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1424
 2026-05-26 19:16:43 -05:00
Andrey Skvortsov 13a3ee81a3 libmm-glib: add more tests for MMLocationGpsNmea 
Extra tests cover various corner cases.

Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
 2026-05-26 20:56:53 +00:00
Dan Williams c0d9497066 libmm-glib: add tests for MMLocationGpsNmea 
Signed-off-by: Dan Williams <dan@ioncontrol.co>
 2026-05-26 20:56:53 +00:00
Andrey Skvortsov f7da97989b location-gps-nmea: add complete sequence to traces at once 
Currently sequence messages are added to traces as they are
received. Therefore content of traces depends at the time, when
request is issued and data is reported. Sometimes not all sequence
traces are reported, because only first record was received yet and it
overwrote previous full sequence trace.

For example,

```
$GPGSV,3,1,12,01,35,282,,02,68,264,,03,02,243,,08,35,206,,1*68
$GPGSV,3,2,12,10,46,074,,14,16,312,,17,,,,22,16,327,,1*53
$GPGSV,3,3,12,23,07,068,,24,15,030,,27,14,181,,32,51,120,,1*60

$GLGSV,2,1,08,82,25,135,,76,11,029,,75,21,334,,69,11,201,,1*7A
```

one GSV sentence is missing and second later full sequence is
reported

```
$GPGSV,3,1,12,01,35,282,,02,68,264,,03,02,243,,08,35,206,,1*68
$GPGSV,3,2,12,10,46,074,,14,16,312,,17,,,,22,16,327,,1*53
$GPGSV,3,3,12,23,07,068,,24,15,030,,27,14,181,,32,51,120,,1*60

$GLGSV,2,1,08,82,25,135,,76,11,029,,75,21,334,,69,11,201,,1*7A
$GLGSV,2,2,08,84,40,306,,83,79,161,,67,56,056,,68,58,177,,1*7D
```

Therefore client software reports different number of visible
satellites.

Usually sequence sentences are reported consequently in NMEA
stream. Let's cache and join sequence sentences until new trace type
is received. In that case full sequence always overrides
previous full sequence.

Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
 2026-05-26 20:56:53 +00:00
Andrey Skvortsov 38548fedd3 location-gps-nmea: use g_autofree in location_gps_nmea_take_trace to track ownership 
It allows simplify error handling.

Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
 2026-05-26 20:56:53 +00:00
Dan Williams 42ca47472a Merge request !1431 from 'add-kk-l10n' 
i18n: Add Kazakh translation

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1431
 2026-05-25 10:10:36 -05:00
Baurzhan Muftakhidinov 027c8c068c po: add Kazakh translation 
Signed-off-by: Baurzhan Muftakhidinov <baurthefirst@gmail.com>
 2026-05-25 10:09:47 -05:00
Dan Williams 62a967131d Merge request !1427 from 'bulgarian' 
po: add Bulgarian translation

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1427
 2026-05-24 10:59:27 -05:00
twlvnn 07704018dd po: add Bulgarian translation 
Signed-off-by: twlvnn <kraft_werk@tutanota.com>
 2026-05-24 10:57:44 -05:00
Dan Williams de5058c283 Merge request !1429 from 'l10n-sv' 
po: Update Swedish translation

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1429
 2026-05-24 08:47:15 -05:00
Anders Jonsson fc1b1e9b1e po: Update Swedish translation 
Signed-off-by: Anders Jonsson <anders.jonsson@norsjovallen.se>
 2026-05-24 08:43:49 -05:00
Dan Williams 87c88dc237 Merge request !1421 from 'xmm7360-assert-cleanup' 
intel: XMM7360: convert message parsing g_assert()s to GErrors and split out protocol functions

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1421

Closes #1034
 2026-05-24 08:36:57 -05:00
Dan Williams a94dd40a2a intel: XMM7360: convert remaining asserts to error checks 
Return useful errors rather than asserting on unexpected responses.

Signed-off-by: Dan Williams <dan@ioncontrol.co>
 2026-05-24 08:33:48 -05:00
Dan Williams fd98a809af sierra: enable XMM7160-based devices like Comneon HL7588 
Signed-off-by: Dan Williams <dan@ioncontrol.co>
 2026-05-24 08:33:48 -05:00
Dan Williams a486776a44 intel: XMM7360: better handle negative ASN integers from modem 
The original code for xmm7360_byte_array_read_asn_int() returned
signed integers both from the function and from the returned
Xmm7360RpcMsgArg, but didn't handle sign extension on the
value returned from the function. That would lead to different
values between the function return and the Xmm7360RpcMsgArg
value, which seems wrong.

Make those two correspond and add checks in various places that
shouldn't ever see negative ints.

Signed-off-by: Dan Williams <dan@ioncontrol.co>
 2026-05-24 08:33:48 -05:00
Dan Williams d6fe0722c9 intel: XMM7360: add xmmrpc protocol test infrastructure 
Signed-off-by: Dan Williams <dan@ioncontrol.co>
 2026-05-24 08:33:48 -05:00
Dan Williams 64d8053413 intel: XMM7360: move Xmm7360RpcMsgArgType UNKNOWN value first in enum 
That way UNKNOWN is the zero'd value instead of BYTE; it's easier
to test for and less error-prone if not explicitly set to the right
value.

Signed-off-by: Dan Williams <dan@ioncontrol.co>
 2026-05-24 08:33:48 -05:00
Dan Williams 4fead86d24 intel: XMM7360: better handling of silly ASN int sizes 
xmm7360_byte_array_read_asn_int() would keep bit-shifting a gint into
oblivion if the int's size was > 32-bit. It also didn't handle size 0
ints at all, and while size 24 ints would get stuffed into a 32-bit
variable those probably aren't a thing and if they actually are they
should get specifically handled.

Signed-off-by: Dan Williams <dan@ioncontrol.co>
 2026-05-24 08:33:48 -05:00
Dan Williams 3f7b39075c intel: XMM7360: move standalone protocol functions to their own file 
So we can unit-test all the parsing and building code more easily
without having to link to a bunch of serial port stuff.

Signed-off-by: Dan Williams <dan@ioncontrol.co>
 2026-05-24 08:33:48 -05:00
Dan Williams 07dc7e7304 intel: XMM7360: return a GError from parse_response_xmm7360() 
Signed-off-by: Dan Williams <dan@ioncontrol.co>
 2026-05-24 08:33:48 -05:00
Dan Williams 1565e3ada7 intel: XMM7360: convert message parsing g_assert()s to GErrors (#1034) 
We shouldn't be g_asserting (and thus crashing) on untrusted input code;
should instead check validity and return an error that upper layers
can reasonbly log and handle.

Fixes: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/1034

Signed-off-by: Dan Williams <dan@ioncontrol.co>
 2026-05-24 08:33:48 -05:00
Dan Williams 174f17f6ea Merge request !1438 from 'mtk_legacy_fix_err_memleak' 
broadband-modem-mtk-legacy: fix `GError` memory leak

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1438
 2026-05-24 08:15:06 -05:00
Barnabás Pőcze 62cc4de68e broadband-modem-mtk-legacy: fix GError memory leak 
If the error matches, then a `+CIMI` command is sent to the device and
processing continues. However, the current error (for the `+CPIN?` command)
is not freed or propagated, fix that.

Fixes: 5c1fcbfe4a ("mtk-legacy: read IMSI if CPIN response is an error")
Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
 2026-05-24 08:12:41 -05:00
Dan Williams a02355c5ce Merge request !1448 from 'qmi/handle-shuttingdown' 
ModemManager: handle QMI_DMS_OPERATING_MODE_SHUTTING_DOWN similar as OFFLINE

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1448
 2026-05-12 12:48:51 -05:00