Modbus: Stack corruption on modbus RTU

[DineshDK03]

I am working on a project related to the Modbus serial.

HW setup:
The custom board based on nrf9160 IC with LTC2873 [used for toggling between RS232 and RS485 connection] where Modbus UART from nrf9160 is connected to this USB converter and a separate Jlink is used for programming.

SW setup:
Latest mainline Zephyr and 0.16.1 SDK

issue:
Making hardware connections for RS485 with the USB to RS232/RS485 converter's USB end left open/ not connected to any devices and selecting RS232 in software configuration for tests/subsys/modbus/ application causes stack corruption and device reboots.

Output:

[00:00:41.321,350] <dbg> modbus_serial: rtu_tx_adu: uart_buf
                                        01 03 00 00 00 01 84 0a                          |........         
[00:00:41.321,350] <dbg> modbus_serial: rtu_tx_adu: Start frame transmission
[00:00:41.602,111] <err> os: ***** BUS FAULT *****          
[00:00:41.602,142] <err> os:   Precise data bus error           
[00:00:41.602,142] <err> os:   BFAR Address: 0xff0000      
[00:00:41.602,172] <err> os: r0/a1:  0x00000003  r1/a2:  0x2000c9f0  r2/a3:  0x00000000
[00:00:41.602,172] <err> os: r3/a4:  0x20013f14 r12/ip:  0x00000000 r14/lr:  0x00041b4b
[00:00:41.602,172] <err> os:  xpsr:  0x41000041
[00:00:41.602,172] <err> os: Faulting instruction address (r15/pc): 0x00035faa
[00:00:41.602,203] <err> os: >>> ZEPHYR FATAL ERROR 0: CPU exception on CPU 0
[00:00:41.602,203] <err> os: Fault during interrupt handling

[00:00:41.602,233] <err> os: Current thread: 0x20012f10 (unknown)
[00:00:41.966,461] <err> fatal_error: Resetting system

Other observations:

1. IT DOES NOT reboot when USB to RS232/RS485 converter's USB end is connected to the PC.
2. IT DOES NOT reboot when both HW and SW are configured with RS485.

[DineshDK03]

Author: Dinesh Kumar K <[email protected]>
Date:   Fri Apr 21 12:31:09 2023 +0530

    subsys: modbus: reset buf_ctr and buf_ptr on modbus serial
    
    Reset buf_ctr and buf_ptr when unit_id received
    as 0, it is not permitted in modbus RTU response
    frame as per specification.
    
    Signed-off-by: Dinesh Kumar K <[email protected]>

diff --git a/subsys/modbus/modbus_serial.c b/subsys/modbus/modbus_serial.c
index 13ad3c84a1..a7f90e432b 100644
--- a/subsys/modbus/modbus_serial.c
+++ b/subsys/modbus/modbus_serial.c
@@ -349,6 +349,12 @@ static void cb_handler_rx(struct modbus_context *ctx)
 
                cfg->uart_buf_ptr += n;
                cfg->uart_buf_ctr += n;
+               /* modbus unit id never be 0*/
+               if (cfg->uart_buf[0] == 0) {
+                       cfg->uart_buf_ptr = &cfg->uart_buf[0];
+                       cfg->uart_buf_ctr = 0;
+
+               }
        }
 }

This is the possible solution I can give, someone helps me with whether a proposed solution is correct or wrong. Thanks

[jfischer-no]

diff --git a/subsys/modbus/modbus_serial.c b/subsys/modbus/modbus_serial.c
index 13ad3c84a1..a7f90e432b 100644
--- a/subsys/modbus/modbus_serial.c
+++ b/subsys/modbus/modbus_serial.c
@@ -349,6 +349,12 @@ static void cb_handler_rx(struct modbus_context *ctx)

            cfg->uart_buf_ptr += n;
            cfg->uart_buf_ctr += n;

•           /* modbus unit id never be 0*/
  

•           if (cfg->uart_buf[0] == 0) {
  

•                   cfg->uart_buf_ptr = &cfg->uart_buf[0];
  

•                   cfg->uart_buf_ctr = 0;
  

•           }
    }
  

}

From the Implementation Guide,
"The MODBUS slave device addresses on serial line are assigned from 1 to
247 (decimal). Address 0 is used as broadcast address.". So, 0 is valid id.

[parthitce]

@jfischer-no Ping for help!

[jfischer-no]

I am working on a project related to the Modbus serial.

HW setup: The custom board based on nrf9160 IC with LTC2873 [used for toggling between RS232 and RS485 connection] where Modbus UART from nrf9160 is connected to this USB converter and a separate Jlink is used for programming.

SW setup: Latest mainline Zephyr and 0.16.1 SDK

issue: Making hardware connections for RS485 with the USB to RS232/RS485 converter's USB end left open/ not connected to any devices and selecting RS232 in software configuration for tests/subsys/modbus/ application causes stack corruption and device reboots.

Output:

[00:00:41.321,350] <dbg> modbus_serial: rtu_tx_adu: uart_buf
                                        01 03 00 00 00 01 84 0a                          |........         
[00:00:41.321,350] <dbg> modbus_serial: rtu_tx_adu: Start frame transmission
[00:00:41.602,111] <err> os: ***** BUS FAULT *****          
[00:00:41.602,142] <err> os:   Precise data bus error           
[00:00:41.602,142] <err> os:   BFAR Address: 0xff0000      
[00:00:41.602,172] <err> os: r0/a1:  0x00000003  r1/a2:  0x2000c9f0  r2/a3:  0x00000000
[00:00:41.602,172] <err> os: r3/a4:  0x20013f14 r12/ip:  0x00000000 r14/lr:  0x00041b4b
[00:00:41.602,172] <err> os:  xpsr:  0x41000041
[00:00:41.602,172] <err> os: Faulting instruction address (r15/pc): 0x00035faa
[00:00:41.602,203] <err> os: >>> ZEPHYR FATAL ERROR 0: CPU exception on CPU 0
[00:00:41.602,203] <err> os: Fault during interrupt handling

[00:00:41.602,233] <err> os: Current thread: 0x20012f10 (unknown)
[00:00:41.966,461] <err> fatal_error: Resetting system

Other observations:

1. IT DOES NOT reboot when USB to RS232/RS485 converter's USB end is connected to the PC.

2. IT DOES NOT reboot when both HW and SW are configured with RS485.

This description is a bit weird. tests/subsys/modbus/ is not an application and not a sample for users. But the "Output" looks like it is from samples/subsys/modbus/tcp_gateway sample because "01 03 00 00 00 01 84 0a" is valid RTU request (Unit 01, FC03, Addr 0, qty 1, CRC okay).