Project

General

Profile

Bug #4606

osmo-bts-trx: global-buffer-overflow in trx_if_send_burst()

Added by pespin 11 months ago. Updated 11 months ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
osmo-bts-trx
Target version:
Start date:
06/09/2020
Due date:
% Done:

100%

Spec Reference:

Description

I just got this using master osmo-bts with a few more patches (non-related, TRXC NOMTXPOWER and rump up stuff).
I was testing #4006 and patch https://gerrit.osmocom.org/c/osmo-bts/+/17766 by using "osmotrx fn-advance 2" on phy 0 running a B200 with multi-arfcn enabled (2TRX).

20200609171243003 DTRX <000b> trx_if.c:122 phy0.0: Clock indication: fn=2566102
20200609171243003 DL1C <0006> scheduler_trx.c:1871 TRX Clock Ind: elapsed_us= 997359, elapsed_fn=216, error_us= +519
20200609171243003 DL1C <0006> scheduler_trx.c:1890 GSM clock jitter: -696us (elapsed_fn=0)
20200609171244000 DTRX <000b> trx_if.c:122 phy0.0: Clock indication: fn=2566318
20200609171244000 DL1C <0006> scheduler_trx.c:1871 TRX Clock Ind: elapsed_us= 997798, elapsed_fn=216, error_us= +958
20200609171244000 DL1C <0006> scheduler_trx.c:1890 GSM clock jitter: -1572us (elapsed_fn=0)
=================================================================
==633279==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5555557ff994 at pc 0x7ffff762c2a6 bp 0x7fffffffd7a0 sp 0x7fffffffcf48
READ of size 444 at 0x5555557ff994 thread T0
    #0 0x7ffff762c2a5 in __interceptor_memcpy /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:806
    #1 0x5555556f11c5 in trx_if_send_burst /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/trx_if.c:1146
    #2 0x55555571d36f in trx_sched_fn /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/scheduler_trx.c:1661
    #3 0x55555571e48a in trx_fn_timer_cb /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/scheduler_trx.c:1758
    #4 0x7ffff683af76 in osmo_fd_disp_fds /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:227
    #5 0x7ffff683b35b in _osmo_select_main /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:265
    #6 0x7ffff683b43a in osmo_select_main /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:274
    #7 0x5555557c8306 in bts_main /home/pespin/dev/sysmocom/git/osmo-bts/src/common/main.c:354
    #8 0x5555556e5027 in main /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/main.c:159
    #9 0x7ffff5bf4001 in __libc_start_main (/usr/lib/libc.so.6+0x27001)
    #10 0x5555556e41fd in _start (/home/pespin/dev/sysmocom/build/new/out/bin/osmo-bts-trx+0x1901fd)

0x5555557ff994 is located 0 bytes to the right of global variable 'dummy_burst' defined in '/home/pespin/dev/sysmocom/git/osmo-bts/src/common/scheduler.c:53:21' (0x5555557ff900) of size 148
0x5555557ff994 is located 44 bytes to the left of global variable '_sched_fcch_burst' defined in '/home/pespin/dev/sysmocom/git/osmo-bts/src/common/scheduler.c:64:14' (0x5555557ff9c0) of size 148
SUMMARY: AddressSanitizer: global-buffer-overflow /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:806 in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x0aab2aaf7ee0: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aab2aaf7ef0: 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0aab2aaf7f00: 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0aab2aaf7f10: 00 02 f9 f9 f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9
  0x0aab2aaf7f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0aab2aaf7f30: 00 00[04]f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0aab2aaf7f40: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9
  0x0aab2aaf7f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aab2aaf7f60: 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
  0x0aab2aaf7f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aab2aaf7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==633279==ABORTING

Program received signal SIGABRT, Aborted.
--Type <RET> for more, q to quit, c to continue without paging--
0x00007ffff5c09355 in raise () from /usr/lib/libc.so.6
(gdb)

Associated revisions

Revision 0bf87ccc (diff)
Added by pespin 11 months ago

scheduler: Fix reading out of buffer during tx of dummy burst on PDCH TS with EGPRS enabled

If for whatever reason (eg fn-advance too small) there's no burst
available for a PDCH TS where EGPRS is enabled, a dummy burst of size GSM_BURST_LEN
would be selected in _sched_dl_burst(), but the nbits length would still be set to
EGPRS_BURST_LEN above by func() pointer (tx_pdtch_fn()).
As a result, trx_if_send_burst() would later read EGPRS_BURST_LEN from the
dummy burst of size GSM_BURST_LEN.

The issue was found by ASan. See OS#4606 for more info.

Fixes: OS#4606
Change-Id: Iba6ccceed5c0f1db810259768678f174d39cbf8b

History

#1 Updated by pespin 11 months ago

(gdb) bt
#0  0x00007ffff5c09355 in raise () from /usr/lib/libc.so.6
#1  0x00007ffff5bf2853 in abort () from /usr/lib/libc.so.6
#2  0x00007ffff76c2a34 in __sanitizer::Abort ()
    at /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:155
#3  0x00007ffff76ce53d in __sanitizer::Die ()
    at /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
#4  0x00007ffff76ad99e in __asan::ScopedInErrorReport::~ScopedInErrorReport (
    this=0x7fffffffc2c6, __in_chrg=<optimized out>)
    at /build/gcc/src/gcc/libsanitizer/asan/asan_report.cpp:186
#5  0x00007ffff76ad222 in __asan::ReportGenericError (pc=140737343832742,
    bp=bp@entry=140737488344992, sp=sp@entry=140737488342856,
    addr=addr@entry=93824995031444, is_write=is_write@entry=false,
    access_size=access_size@entry=444, exp=0, fatal=false)
    at /build/gcc/src/gcc/libsanitizer/asan/asan_report.cpp:193
#6  0x00007ffff762c2c6 in __interceptor_memcpy (dst=0x7fffffffd816,
    src=0x5555557ff900 <dummy_burst>, size=444)
    at /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:806
#7  0x00005555556f11c6 in trx_if_send_burst (l1h=0x62f00000e460, tn=7 '\a',
    fn=2566369, pwr=0 '\000', bits=0x5555557ff900 <dummy_burst> "", nbits=444)
    at /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/trx_if.c:1146
--Type <RET> for more, q to quit, c to continue without paging--frame
#8  0x000055555571d370 in trx_sched_fn (bts=0x627000000160, fn=2566369)
    at /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/scheduler_trx.c:1661
#9  0x000055555571e48b in trx_fn_timer_cb (ofd=0x611000006758, what=1)
    at /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/scheduler_trx.c:1758
#10 0x00007ffff683af77 in osmo_fd_disp_fds (_rset=0x7fffffffddc0,
    _wset=0x7fffffffde60, _eset=0x7fffffffdf00)
    at /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:227
#11 0x00007ffff683b35c in _osmo_select_main (polling=0)
    at /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:265
#12 0x00007ffff683b43b in osmo_select_main (polling=0)
    at /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:274
#13 0x00005555557c8307 in bts_main (argc=7, argv=0x7fffffffe228)
    at /home/pespin/dev/sysmocom/git/osmo-bts/src/common/main.c:354
#14 0x00005555556e5028 in main (argc=7, argv=0x7fffffffe228)
    at /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/main.c:159

It seems global buffer dummy_burst (static const ubit_t dummy_burst[GSM_BURST_LEN] = {) of size GSM_BURST_LEN=148 is being passed but since I'm using EGPRS, one of EGPRS_BURST_LEN=444
should be passed.

#2 Updated by pespin 11 months ago

It seems TS 05.02 chapter 5.2.6 only defines bursts for GMSK afaiu https://www.etsi.org/deliver/etsi_ts/100900_100999/100908/08.11.00_60/ts_100908v081100p.pdf

We could do this to fix the issue once find out which kind of burst we need to send there:

diff --git a/src/common/scheduler.c b/src/common/scheduler.c
index 55cb36a7..f22feb4f 100644
--- a/src/common/scheduler.c
+++ b/src/common/scheduler.c
@@ -1210,7 +1210,13 @@ no_data:
                             "burst=%d on C0, so filling with dummy burst\n",
                             trx_chan_desc[chan].name, fn, tn, bid);
 #endif
-               bits = (ubit_t *) dummy_burst;
+               if (nbits == GSM_BURST_LEN)
+                       bits = (ubit_t *) dummy_burst;
+               else if (nbits == EGPRS_BURST_LEN)
+                       bits = (ubit_t *) egprs_dummy_burst;
+               else
+                       osmo_panic("%s:%d Requested dummy burst for invalid burst len %d\n",
+                                  __FILE__, __LINE__, nbits);
        }

        return bits;

#3 Updated by pespin 11 months ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 90

I finally simply set nbits to the correct buffer size.

Should be fixed by:
remote: https://gerrit.osmocom.org/c/osmo-bts/+/18750 scheduler.c: Fix trailing whitespace
remote: https://gerrit.osmocom.org/c/osmo-bts/+/18751 scheduler: Fix reading out of buffer during tx of dummy burst on PDCH TS ...

#4 Updated by pespin 11 months ago

  • Status changed from Feedback to Resolved
  • % Done changed from 90 to 100

Merged, closing.

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)