[Bug] [netdev] ping crashes the shell with a division by zero when the target is unreachable (received == 0)

已關閉 適合新手
  • 哪裡不對？
#11,852 3 則留言 0 個 reaction 已指派 1 人 在 GitHub 檢視

維護者通常 1 天內回覆

@ymj0440 已經在處理了。

開始於 2026年10月11日。

  • #11853 來自 @r3wretrhy —— 未關閉
  • #11862 來自 @ymj0440 —— 未關閉

評估

難度
1/5
預估耗時
1 小時以內
新手友好度
90/100
Issue 類型
缺陷
描述清晰度
描述清楚
活躍度
活躍
技術堆疊
c
領域
networking

研究方向

從 components/net/netdev/src/netdev.c 的 netdev_cmd_ping 函式開始，大約在第 1428 行，avg_time = (uint32_t)(avg_time / received) 在四行之下既有的 if (received > 0) 守衛之前執行；將該守衛移動或複製到除法周圍。透過建置 bsp/simulator、註冊一個 ops->ping 以 flags UP|LINK_UP 回傳 -RT_ETIMEOUT 的 netdev、在 msh 中執行 'ping 192.0.2.1'，並確認統計資料印出 100% loss 而非 FPE 來驗證。完成 = 沒有 fault，且無法到達目標的路徑仍然印出 loss 統計。

由索引模型根據 Issue 內容生成。

描述

bug Component component: net in progress
RT-Thread Version

master c3e94f7b (2026-09-23)

Affected area

Networking

Hardware/BSP vendor

Not applicable / Other

Architecture

Not applicable / Other

Board and hardware details

bsp/simulator on Linux x86-64 (kernel ASan enabled by the BSP) — no real board required; the defect is in the generic netdev layer (components/net/netdev/src/netdev.c).

Develop Toolchain

GCC

Describe the bug

netdev_cmd_ping() divides by the reply counter received when printing
statistics, without checking it is non-zero. When every ping attempt times
out (target unreachable — the most common diagnostic scenario), received
stays 0 and the integer division faults: SIGFPE on x86, division-by-zero
HardFault on Cortex-M. The shell thread (rt_kprintf side) dies — the msh
console becomes unusable or the device resets.

Note the guard exists but guards the wrong statement — four lines below the
division:

/* components/net/netdev/src/netdev.c:1428 (master 005d291) */
avg_time = (uint32_t)(avg_time / received);      /* received == 0 -> fault */
...
if (received > 0)                                 /* guard only here */
{
    rt_kprintf("minimum = %dms, ...\n", min_time, max_time, avg_time);
}

Steps to reproduce (any device with ops->ping implemented, up and
link-up — default for a configured netdev):

  1. Register a test netdev through the public API with ops->ping returning
    -RT_ETIMEOUT and flags UP | LINK_UP:
/* in the simulator app, before running "ping" */
static rt_err_t test_ping(struct netdev *d, const char *h, size_t s,
                          struct netdev_ping_resp *r) { return -RT_ETIMEOUT; }
/* netdev_register() with ops = {..., .ping = test_ping}, flags UP|LINK_UP */
  1. Run the standard shell entry:
msh> ping 192.0.2.1
  1. After the 4 timeouts, the statistics path divides by zero:
AddressSanitizer: FPE on unknown address 0x...
    #0 netdev_cmd_ping components/net/netdev/src/netdev.c:1428

(Control: the same netdev registered without LINK_UP returns cleanly
via the guard path — "ping: ... status error", no fault. The division is the
sole crash point.)

Expected behavior: statistics print with 100% loss and no average, no
fault — one-line fix mirroring the existing guard:

if (received > 0) avg_time = (uint32_t)(avg_time / received);
Other additional context
  • The fault hits the shell thread, so the console/monitoring channel dies
    until reset — DoS of the management interface from a routine operation.
主要語言
C
星號
12.3k
分支
5.5k
平均合併
5 天 1 小時
30 天內合併 PR
32

環境準備

在 Codespaces 中開啟

在瀏覽器裡用你自己的 GitHub 帳號啟動這個專案的開發容器。

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

RT-Thread/rt-thread 的其他 Issue

查看 RT-Thread/rt-thread 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。