Bug #4606
closedosmo-bts-trx: global-buffer-overflow in trx_if_send_burst()
100%
Description
I just got this using master osmo-bts with a few more patches (non-related, TRXC NOMTXPOWER and rump up stuff).
I was testing #4006 and patch https://gerrit.osmocom.org/c/osmo-bts/+/17766 by using "osmotrx fn-advance 2" on phy 0 running a B200 with multi-arfcn enabled (2TRX).
20200609171243003 DTRX <000b> trx_if.c:122 phy0.0: Clock indication: fn=2566102 20200609171243003 DL1C <0006> scheduler_trx.c:1871 TRX Clock Ind: elapsed_us= 997359, elapsed_fn=216, error_us= +519 20200609171243003 DL1C <0006> scheduler_trx.c:1890 GSM clock jitter: -696us (elapsed_fn=0) 20200609171244000 DTRX <000b> trx_if.c:122 phy0.0: Clock indication: fn=2566318 20200609171244000 DL1C <0006> scheduler_trx.c:1871 TRX Clock Ind: elapsed_us= 997798, elapsed_fn=216, error_us= +958 20200609171244000 DL1C <0006> scheduler_trx.c:1890 GSM clock jitter: -1572us (elapsed_fn=0) ================================================================= ==633279==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5555557ff994 at pc 0x7ffff762c2a6 bp 0x7fffffffd7a0 sp 0x7fffffffcf48 READ of size 444 at 0x5555557ff994 thread T0 #0 0x7ffff762c2a5 in __interceptor_memcpy /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:806 #1 0x5555556f11c5 in trx_if_send_burst /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/trx_if.c:1146 #2 0x55555571d36f in trx_sched_fn /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/scheduler_trx.c:1661 #3 0x55555571e48a in trx_fn_timer_cb /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/scheduler_trx.c:1758 #4 0x7ffff683af76 in osmo_fd_disp_fds /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:227 #5 0x7ffff683b35b in _osmo_select_main /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:265 #6 0x7ffff683b43a in osmo_select_main /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:274 #7 0x5555557c8306 in bts_main /home/pespin/dev/sysmocom/git/osmo-bts/src/common/main.c:354 #8 0x5555556e5027 in main /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/main.c:159 #9 0x7ffff5bf4001 in __libc_start_main (/usr/lib/libc.so.6+0x27001) #10 0x5555556e41fd in _start (/home/pespin/dev/sysmocom/build/new/out/bin/osmo-bts-trx+0x1901fd) 0x5555557ff994 is located 0 bytes to the right of global variable 'dummy_burst' defined in '/home/pespin/dev/sysmocom/git/osmo-bts/src/common/scheduler.c:53:21' (0x5555557ff900) of size 148 0x5555557ff994 is located 44 bytes to the left of global variable '_sched_fcch_burst' defined in '/home/pespin/dev/sysmocom/git/osmo-bts/src/common/scheduler.c:64:14' (0x5555557ff9c0) of size 148 SUMMARY: AddressSanitizer: global-buffer-overflow /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:806 in __interceptor_memcpy Shadow bytes around the buggy address: 0x0aab2aaf7ee0: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x0aab2aaf7ef0: 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x0aab2aaf7f00: 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x0aab2aaf7f10: 00 02 f9 f9 f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9 0x0aab2aaf7f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0aab2aaf7f30: 00 00[04]f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x0aab2aaf7f40: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 0x0aab2aaf7f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0aab2aaf7f60: 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 0x0aab2aaf7f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0aab2aaf7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==633279==ABORTING Program received signal SIGABRT, Aborted. --Type <RET> for more, q to quit, c to continue without paging-- 0x00007ffff5c09355 in raise () from /usr/lib/libc.so.6 (gdb)
Updated by pespin almost 4 years ago
(gdb) bt #0 0x00007ffff5c09355 in raise () from /usr/lib/libc.so.6 #1 0x00007ffff5bf2853 in abort () from /usr/lib/libc.so.6 #2 0x00007ffff76c2a34 in __sanitizer::Abort () at /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:155 #3 0x00007ffff76ce53d in __sanitizer::Die () at /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58 #4 0x00007ffff76ad99e in __asan::ScopedInErrorReport::~ScopedInErrorReport ( this=0x7fffffffc2c6, __in_chrg=<optimized out>) at /build/gcc/src/gcc/libsanitizer/asan/asan_report.cpp:186 #5 0x00007ffff76ad222 in __asan::ReportGenericError (pc=140737343832742, bp=bp@entry=140737488344992, sp=sp@entry=140737488342856, addr=addr@entry=93824995031444, is_write=is_write@entry=false, access_size=access_size@entry=444, exp=0, fatal=false) at /build/gcc/src/gcc/libsanitizer/asan/asan_report.cpp:193 #6 0x00007ffff762c2c6 in __interceptor_memcpy (dst=0x7fffffffd816, src=0x5555557ff900 <dummy_burst>, size=444) at /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:806 #7 0x00005555556f11c6 in trx_if_send_burst (l1h=0x62f00000e460, tn=7 '\a', fn=2566369, pwr=0 '\000', bits=0x5555557ff900 <dummy_burst> "", nbits=444) at /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/trx_if.c:1146 --Type <RET> for more, q to quit, c to continue without paging--frame #8 0x000055555571d370 in trx_sched_fn (bts=0x627000000160, fn=2566369) at /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/scheduler_trx.c:1661 #9 0x000055555571e48b in trx_fn_timer_cb (ofd=0x611000006758, what=1) at /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/scheduler_trx.c:1758 #10 0x00007ffff683af77 in osmo_fd_disp_fds (_rset=0x7fffffffddc0, _wset=0x7fffffffde60, _eset=0x7fffffffdf00) at /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:227 #11 0x00007ffff683b35c in _osmo_select_main (polling=0) at /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:265 #12 0x00007ffff683b43b in osmo_select_main (polling=0) at /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:274 #13 0x00005555557c8307 in bts_main (argc=7, argv=0x7fffffffe228) at /home/pespin/dev/sysmocom/git/osmo-bts/src/common/main.c:354 #14 0x00005555556e5028 in main (argc=7, argv=0x7fffffffe228) at /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/main.c:159
It seems global buffer dummy_burst (static const ubit_t dummy_burst[GSM_BURST_LEN] = {) of size GSM_BURST_LEN=148 is being passed but since I'm using EGPRS, one of EGPRS_BURST_LEN=444
should be passed.
Updated by pespin almost 4 years ago
It seems TS 05.02 chapter 5.2.6 only defines bursts for GMSK afaiu https://www.etsi.org/deliver/etsi_ts/100900_100999/100908/08.11.00_60/ts_100908v081100p.pdf
We could do this to fix the issue once find out which kind of burst we need to send there:
diff --git a/src/common/scheduler.c b/src/common/scheduler.c index 55cb36a7..f22feb4f 100644 --- a/src/common/scheduler.c +++ b/src/common/scheduler.c @@ -1210,7 +1210,13 @@ no_data: "burst=%d on C0, so filling with dummy burst\n", trx_chan_desc[chan].name, fn, tn, bid); #endif - bits = (ubit_t *) dummy_burst; + if (nbits == GSM_BURST_LEN) + bits = (ubit_t *) dummy_burst; + else if (nbits == EGPRS_BURST_LEN) + bits = (ubit_t *) egprs_dummy_burst; + else + osmo_panic("%s:%d Requested dummy burst for invalid burst len %d\n", + __FILE__, __LINE__, nbits); } return bits;
Updated by pespin almost 4 years ago
- Status changed from New to Feedback
- % Done changed from 0 to 90
I finally simply set nbits to the correct buffer size.
Should be fixed by:
remote: https://gerrit.osmocom.org/c/osmo-bts/+/18750 scheduler.c: Fix trailing whitespace
remote: https://gerrit.osmocom.org/c/osmo-bts/+/18751 scheduler: Fix reading out of buffer during tx of dummy burst on PDCH TS ...
Updated by pespin almost 4 years ago
- Status changed from Feedback to Resolved
- % Done changed from 90 to 100
Merged, closing.