Test the fix in MR !1469 that fixes the issue in #840.
If a multi-part PDU is sent from a device to its own number, on receipt
the DELIVER PDU was incorrectly dropped because when comparing the new
parts to existing ones, the comparison found the original SUBMIT PDU.
Signed-off-by: Dan Williams <dan@ioncontrol.co>
The patch resolves a coredump caused by using 'client' instead of 'self'
in mm_obj_warn() call when failing to register tracking events.
Signed-off-by: shuihan-001 <xing1989093@outlook.com>
On my modem, AT!ICCID? command gives response without a preceding `!`:
```
AT!ICCID?
ICCID: 8970162010103256136
OK
```
Signed-off-by: Semyon Maryasin <simeon@maryasin.name>
device_caps_query_ready() declares caps_custom_data_class_str as
g_autofree without an initializer. On every early error return
(command failure such as a transaction timeout or NotOpened, or a
response parse failure) the variable is never assigned, so the
autofree cleanup runs g_free() on uninitialized stack garbage,
crashing ModemManager with a glibc "invalid free" abort (or SIGSEGV)
whenever the device caps query fails during modem initialization.
Fixes: 19c817cfe9 ("broadband-modem-mbim: consistently handle custom data classes")
Closes: #1094
Signed-off-by: Semyon Maryasin <simeon@maryasin.name>
Update parse_unsolicited() to re-check handler->callback on each
iteration of the match dispatch loop. If a URC handler callback clears
itself during dispatch (e.g. to stop listening), subsequent matches in
the same buffer would attempt to call the NULL pointer, causing a crash.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1074
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Use g_steal_pointer() when passing g_autoptr(GError) to
g_task_return_error() to prevent double-free by the automatic cleanup.
GTask takes ownership of the passed GError. If we use g_autoptr(GError)
locally, it will also call g_error_free() when the function returns,
causing a double-free / heap corruption. Stealing the pointer clears the
local variable and prevents the automatic cleanup.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1073
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Defer the validity change (which triggers modem reprobe/removal) to an
idle callback in rdy_handler().
Calling mm_base_modem_set_valid(FALSE) synchronously from the URC
handler triggers the immediate destruction of the modem object while the
serial port is still iterating the unsolicited message handlers. Deferring
the operation to an idle callback and taking a reference to the modem
ensures the modem object is kept alive until parse_unsolicited() has
returned.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1072
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Disconnect the 'list-configs' indication handler immediately inside the
callback. If the modem sends a duplicate indication before the whole
config load sequence completes, it could overwrite the stored
'get-config-info' signal handler ID, orphaning the old handler and
leading to a Use-After-Free when the GTask is completed and the
orphaned handler eventually fires.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1071
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Use g_signal_connect_object() to connect to child list/object signals
in the 3GPP, Messaging, Voice, and Cell Broadcast interfaces.
Passing the raw D-Bus skeleton pointer as user_data to these signals
can lead to a Use-After-Free if the skeleton is disposed of (e.g. on
hot-unplug) while the parent object or child list survives. By using
g_signal_connect_object(), the signal handlers are automatically
disconnected when the D-Bus skeleton is destroyed.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1068
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Introduce a timezone poll session ID to validate timezone load
results. This ensures that when a pending timezone load completes, we
discard the result if a new poll session has been started (e.g. due to
registration state changes) or if polling has been stopped.
This prevents leaking GSource timeout sources and a subsequent
Use-After-Free if the modem is hot-unplugged while a poll is pending.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1067
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Validate the number parameter in Voice.CreateCall and Call.Deflect
D-Bus methods to ensure they do not contain control characters or
semicolons. This prevents AT command injection when the number is
later spliced into ATD or +CTFR commands.
Introduce a common helper mm_utils_is_valid_dial_number() to validate
dial numbers, and add unit tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1067
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Validate preferred network operator codes in the SIM D-Bus interface
handler to ensure they are numeric. This prevents injecting AT
command delimiters (like CR) into this field, which is later spliced
into AT commands (+CPOL).
This change also plugs the network list leak, that was a problem on
its own.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1065
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Validate PIN and PUK codes in the SIM D-Bus interface handlers to
ensure they are numeric. This prevents injecting AT command
delimiters (like CR) into these fields, which are later spliced
into AT commands (+CPWD, +CLCK, +CPIN).
Introduce a common helper mm_utils_is_numeric() to check if a string
contains only digits, and add unit tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1065
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
When sending an unencoded USSD command, the user-supplied string was
spliced directly into the +CUSD AT command. If the string contained
CR or semicolons, it could lead to AT command injection.
Use mm_at_quote_string() to properly quote and escape the USSD
command before sending it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1064
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
When parsing a SUPL address, if the host is not a valid IPv4 address,
validate it as a FQDN (allowing only alphanumeric characters, dots,
and hyphens). This prevents injecting AT command delimiters (like CR
or semicolon) into the host string, which is later spliced into
modem-specific AT commands (+XLCSSLP).
Introduce a common helper mm_utils_is_valid_fqdn() to validate FQDNs,
and add unit tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1063
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Alphanumeric SMS addresses decoded from GSM-7 could contain control
characters (like CR/LF), which could lead to AT command injection
if the address is later spliced into an AT+CMGS command during
stored SMS send fallback.
Sanitize the decoded address by removing all control characters.
Introduce a common helper mm_utils_remove_control_characters() to
remove control characters from a string in-place, and add unit
tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1062
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
ME910G1 supports decimal format for 4G bands and has also an empty
tdscdma slot between 4G and 4G extended bands commands/responses.
Change shared code and helpers to deal with these differences.
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
The assumption that if a modem supports a given access tech, the band
settings for that specific tech should be always given is wrong for
4g, since the 4g bands can be disabled setting the value to 0 in
multi-tech modems like ME310M1.
For example, a 3g + 4g modem could have a setting in which all
the 4g bands are unset and only 3g bands are there: this scenario is
not supported by the current code, but it's legitimate.
Remove this limitation and adapt the code to support bands setting
for multi-tech modems.
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Fix LN920 current bands test configuration by setting
modem_has_hex_format_4g_bands to TRUE.
The current wrong setting does not cause the test failure since the modem
supports also extended settings and function telit_get_ext_4g_mm_bands
considers both standard and extended bands as hex without checking
the flag, since decimal format for extended bands is not supported.
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
The original code for xmm7360_byte_array_read_asn_int() returned
signed integers both from the function and from the returned
Xmm7360RpcMsgArg, but didn't handle sign extension on the
value returned from the function. That would lead to different
values between the function return and the Xmm7360RpcMsgArg
value, which seems wrong.
Make those two correspond and add checks in various places that
shouldn't ever see negative ints.
Signed-off-by: Dan Williams <dan@ioncontrol.co>
That way UNKNOWN is the zero'd value instead of BYTE; it's easier
to test for and less error-prone if not explicitly set to the right
value.
Signed-off-by: Dan Williams <dan@ioncontrol.co>
xmm7360_byte_array_read_asn_int() would keep bit-shifting a gint into
oblivion if the int's size was > 32-bit. It also didn't handle size 0
ints at all, and while size 24 ints would get stuffed into a 32-bit
variable those probably aren't a thing and if they actually are they
should get specifically handled.
Signed-off-by: Dan Williams <dan@ioncontrol.co>
So we can unit-test all the parsing and building code more easily
without having to link to a bunch of serial port stuff.
Signed-off-by: Dan Williams <dan@ioncontrol.co>
If the error matches, then a `+CIMI` command is sent to the device and
processing continues. However, the current error (for the `+CPIN?` command)
is not freed or propagated, fix that.
Fixes: 5c1fcbfe4a ("mtk-legacy: read IMSI if CPIN response is an error")
Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
The MTK specific modem object should be included in the 'mtk' shared
utils, so that they're available to other plugins.
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Current cell broadcast messages from missile warnings in Israel
have an addition `00` at the end to pad for an even byte number.
This breaks conversion making the whole message fail conversion. As this
is a 15 part message in 3 languages the whole notification is lost in
this case.
Try harder to convert the message and recover even partial bits.
Closes: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/1042
Signed-off-by: Guido Günther <agx@sigxcpu.org>
The port type hints for the RW101-cat6 and RW101-cat12 have been
updated, with USB interface #2 now designated as both the AT primary
port and fastboot port.
Signed-off-by: Wenbin <ywbjob@163.com>
Dan Williams
Christian Wendt
shuihan-001
Семён Марьясин
Nikolay Savchenko
Andrey Skvortsov
Aleksander Morgado
Daniele Palmas
Lukas Voegl
Barnabás Pőcze
Alexander Couzens
Wenbin
xuhongxing
Guido Günther
Lorenzo Medici