Bug #4946

crash in audio_support

Added by lynxis 7 days ago. Updated 7 days ago.

Target version:
Start date:
Due date:
% Done:


Spec Reference:


  • 1.6.0-455-gf4674e3f7

A pcap file can be given on request. I might have changed the codec via the vty.

           PID: 11246 (osmo-bsc)
           UID: 0 (root)
           GID: 0 (root)
        Signal: 11 (SEGV)
     Timestamp: Thu 2021-01-14 00:37:00 CET (2h 13min ago)
  Command Line: /usr/bin/osmo-bsc -c /etc/osmocom/osmo-bsc.cfg -s
    Executable: /usr/bin/osmo-bsc
 Control Group: /system.slice/osmo-bsc.service
          Unit: osmo-bsc.service
         Slice: system.slice
       Boot ID: 721ef204a4ae4f678f5079f97b243222
    Machine ID: 8b9b6c78d099427aaf5a17fd131e258f
      Hostname: rc3-gsm
       Storage: /var/lib/systemd/coredump/core.osmo-bsc.0.721ef204a4ae4f678f5079f97b243222.11246.1610581020000000.lz4
       Message: Process 11246 (osmo-bsc) of user 0 dumped core.

                Stack trace of thread 11246:
                #0  0x00005559214b8e59 audio_support_to_gsm88 (osmo-bsc)
                #1  0x00005559214b94a0 gen_bss_supported_codec_list (osmo-bsc)
                #2  0x00005559214ea26f bsc_compl_l3 (osmo-bsc)
                #3  0x00005559214bc58d gsm0408_rcvmsg (osmo-bsc)
                #4  0x000055592148f23d abis_rsl_rx_rll (osmo-bsc)
                #5  0x00007f80f2c1e37f handle_ts1_read (
                #6  0x00007f80f2c55add poll_disp_fds (
                #7  0x00007f80f2c55b96 osmo_select_main_ctx (
                #8  0x0000555921477c87 main (osmo-bsc)
                #9  0x00007f80f29fb09b __libc_start_main (
                #10 0x0000555921477d3a _start (osmo-bsc)

Using host libthread_db library "/lib/x86_64-linux-gnu/".
Core was generated by `/usr/bin/osmo-bsc -c /etc/osmocom/osmo-bsc.cfg -s'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00005559214b8e59 in audio_support_to_gsm88 (audio=0x0) at ../../../../src/osmo-bsc/src/osmo-bsc/codec_pref.c:95
95              if (audio->hr) {
(gdb) bt
#0  0x00005559214b8e59 in audio_support_to_gsm88 (audio=0x0) at ../../../../src/osmo-bsc/src/osmo-bsc/codec_pref.c:95
#1  0x00005559214b94a0 in gen_bss_supported_codec_list (scl=scl@entry=0x7fff5f749ea0, msc=0x555921bb0080, bts=bts@entry=0x555921db29f0) at ../../../../src/osmo-bsc/src/osmo-bsc/codec_pref.c:410
#2  0x00005559214ea26f in bsc_compl_l3 (lchan=lchan@entry=0x7f80f20062c8, msg=msg@entry=0x555921e10850, chosen_channel=chosen_channel@entry=0) at ../../../../src/osmo-bsc/src/osmo-bsc/gsm_08_08.c:519
#3  0x00005559214bc58d in gsm0408_rcvmsg (msg=msg@entry=0x555921e10850, link_id=<optimized out>) at ../../../../src/osmo-bsc/src/osmo-bsc/gsm_04_08_rr.c:1030
#4  0x000055592148f23d in abis_rsl_rx_rll (msg=0x555921e10850) at ../../../../src/osmo-bsc/src/osmo-bsc/abis_rsl.c:1996
#5  abis_rsl_rcvmsg (msg=0x555921e10850) at ../../../../src/osmo-bsc/src/osmo-bsc/abis_rsl.c:2499
#6  0x00007f80f2c1e37f in handle_ts1_read (bfd=0x555921e046d0) at ../../../src/libosmo-abis/src/input/ipaccess.c:417
#7  ipaccess_fd_cb (bfd=0x555921e046d0, what=1) at ../../../src/libosmo-abis/src/input/ipaccess.c:557
#8  0x00007f80f2c55add in poll_disp_fds (n_fd=<optimized out>) at ../../../src/libosmocore/src/select.c:350
#9  _osmo_select_main (polling=<optimized out>) at ../../../src/libosmocore/src/select.c:378
#10 0x00007f80f2c55b96 in osmo_select_main_ctx (polling=<optimized out>) at ../../../src/libosmocore/src/select.c:434
#11 0x0000555921477c87 in main (argc=<optimized out>, argv=<optimized out>) at ../../../../src/osmo-bsc/src/osmo-bsc/osmo_bsc_main.c:1026


#1 Updated by fixeria 7 days ago

  • Status changed from New to In Progress
  • Assignee set to fixeria

I managed to reproduce it, the bug is in the VTY command handler.

  1. Go to the VTY, then: 'en' -> 'configure terminal' -> 'msc';
  2. Configure any invalid codec list, e.g. 'codec-list Boom!';
  3. Do 'show running-config', boom!

#2 Updated by fixeria 7 days ago

  • Status changed from In Progress to Resolved
  • % Done changed from 0 to 100 vty: fix 'codec-list' command: check all given arguments first

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)