Project

General

Profile

Actions

Bug #4606

closed

osmo-bts-trx: global-buffer-overflow in trx_if_send_burst()

Added by pespin almost 4 years ago. Updated almost 4 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
osmo-bts-trx
Target version:
Start date:
06/09/2020
Due date:
% Done:

100%

Spec Reference:

Description

I just got this using master osmo-bts with a few more patches (non-related, TRXC NOMTXPOWER and rump up stuff).
I was testing #4006 and patch https://gerrit.osmocom.org/c/osmo-bts/+/17766 by using "osmotrx fn-advance 2" on phy 0 running a B200 with multi-arfcn enabled (2TRX).

20200609171243003 DTRX <000b> trx_if.c:122 phy0.0: Clock indication: fn=2566102
20200609171243003 DL1C <0006> scheduler_trx.c:1871 TRX Clock Ind: elapsed_us= 997359, elapsed_fn=216, error_us= +519
20200609171243003 DL1C <0006> scheduler_trx.c:1890 GSM clock jitter: -696us (elapsed_fn=0)
20200609171244000 DTRX <000b> trx_if.c:122 phy0.0: Clock indication: fn=2566318
20200609171244000 DL1C <0006> scheduler_trx.c:1871 TRX Clock Ind: elapsed_us= 997798, elapsed_fn=216, error_us= +958
20200609171244000 DL1C <0006> scheduler_trx.c:1890 GSM clock jitter: -1572us (elapsed_fn=0)
=================================================================
==633279==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5555557ff994 at pc 0x7ffff762c2a6 bp 0x7fffffffd7a0 sp 0x7fffffffcf48
READ of size 444 at 0x5555557ff994 thread T0
    #0 0x7ffff762c2a5 in __interceptor_memcpy /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:806
    #1 0x5555556f11c5 in trx_if_send_burst /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/trx_if.c:1146
    #2 0x55555571d36f in trx_sched_fn /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/scheduler_trx.c:1661
    #3 0x55555571e48a in trx_fn_timer_cb /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/scheduler_trx.c:1758
    #4 0x7ffff683af76 in osmo_fd_disp_fds /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:227
    #5 0x7ffff683b35b in _osmo_select_main /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:265
    #6 0x7ffff683b43a in osmo_select_main /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:274
    #7 0x5555557c8306 in bts_main /home/pespin/dev/sysmocom/git/osmo-bts/src/common/main.c:354
    #8 0x5555556e5027 in main /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/main.c:159
    #9 0x7ffff5bf4001 in __libc_start_main (/usr/lib/libc.so.6+0x27001)
    #10 0x5555556e41fd in _start (/home/pespin/dev/sysmocom/build/new/out/bin/osmo-bts-trx+0x1901fd)

0x5555557ff994 is located 0 bytes to the right of global variable 'dummy_burst' defined in '/home/pespin/dev/sysmocom/git/osmo-bts/src/common/scheduler.c:53:21' (0x5555557ff900) of size 148
0x5555557ff994 is located 44 bytes to the left of global variable '_sched_fcch_burst' defined in '/home/pespin/dev/sysmocom/git/osmo-bts/src/common/scheduler.c:64:14' (0x5555557ff9c0) of size 148
SUMMARY: AddressSanitizer: global-buffer-overflow /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:806 in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x0aab2aaf7ee0: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aab2aaf7ef0: 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0aab2aaf7f00: 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0aab2aaf7f10: 00 02 f9 f9 f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9
  0x0aab2aaf7f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0aab2aaf7f30: 00 00[04]f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0aab2aaf7f40: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9
  0x0aab2aaf7f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aab2aaf7f60: 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
  0x0aab2aaf7f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aab2aaf7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==633279==ABORTING

Program received signal SIGABRT, Aborted.
--Type <RET> for more, q to quit, c to continue without paging--
0x00007ffff5c09355 in raise () from /usr/lib/libc.so.6
(gdb)

Actions

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)