Actions
Bug #4606
closedosmo-bts-trx: global-buffer-overflow in trx_if_send_burst()
Status:
Resolved
Priority:
Normal
Assignee:
Category:
osmo-bts-trx
Target version:
Start date:
06/09/2020
Due date:
% Done:
100%
Spec Reference:
Description
I just got this using master osmo-bts with a few more patches (non-related, TRXC NOMTXPOWER and rump up stuff).
I was testing #4006 and patch https://gerrit.osmocom.org/c/osmo-bts/+/17766 by using "osmotrx fn-advance 2" on phy 0 running a B200 with multi-arfcn enabled (2TRX).
20200609171243003 DTRX <000b> trx_if.c:122 phy0.0: Clock indication: fn=2566102 20200609171243003 DL1C <0006> scheduler_trx.c:1871 TRX Clock Ind: elapsed_us= 997359, elapsed_fn=216, error_us= +519 20200609171243003 DL1C <0006> scheduler_trx.c:1890 GSM clock jitter: -696us (elapsed_fn=0) 20200609171244000 DTRX <000b> trx_if.c:122 phy0.0: Clock indication: fn=2566318 20200609171244000 DL1C <0006> scheduler_trx.c:1871 TRX Clock Ind: elapsed_us= 997798, elapsed_fn=216, error_us= +958 20200609171244000 DL1C <0006> scheduler_trx.c:1890 GSM clock jitter: -1572us (elapsed_fn=0) ================================================================= ==633279==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5555557ff994 at pc 0x7ffff762c2a6 bp 0x7fffffffd7a0 sp 0x7fffffffcf48 READ of size 444 at 0x5555557ff994 thread T0 #0 0x7ffff762c2a5 in __interceptor_memcpy /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:806 #1 0x5555556f11c5 in trx_if_send_burst /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/trx_if.c:1146 #2 0x55555571d36f in trx_sched_fn /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/scheduler_trx.c:1661 #3 0x55555571e48a in trx_fn_timer_cb /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/scheduler_trx.c:1758 #4 0x7ffff683af76 in osmo_fd_disp_fds /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:227 #5 0x7ffff683b35b in _osmo_select_main /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:265 #6 0x7ffff683b43a in osmo_select_main /home/pespin/dev/sysmocom/git/libosmocore/src/select.c:274 #7 0x5555557c8306 in bts_main /home/pespin/dev/sysmocom/git/osmo-bts/src/common/main.c:354 #8 0x5555556e5027 in main /home/pespin/dev/sysmocom/git/osmo-bts/src/osmo-bts-trx/main.c:159 #9 0x7ffff5bf4001 in __libc_start_main (/usr/lib/libc.so.6+0x27001) #10 0x5555556e41fd in _start (/home/pespin/dev/sysmocom/build/new/out/bin/osmo-bts-trx+0x1901fd) 0x5555557ff994 is located 0 bytes to the right of global variable 'dummy_burst' defined in '/home/pespin/dev/sysmocom/git/osmo-bts/src/common/scheduler.c:53:21' (0x5555557ff900) of size 148 0x5555557ff994 is located 44 bytes to the left of global variable '_sched_fcch_burst' defined in '/home/pespin/dev/sysmocom/git/osmo-bts/src/common/scheduler.c:64:14' (0x5555557ff9c0) of size 148 SUMMARY: AddressSanitizer: global-buffer-overflow /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:806 in __interceptor_memcpy Shadow bytes around the buggy address: 0x0aab2aaf7ee0: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x0aab2aaf7ef0: 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x0aab2aaf7f00: 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x0aab2aaf7f10: 00 02 f9 f9 f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9 0x0aab2aaf7f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0aab2aaf7f30: 00 00[04]f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x0aab2aaf7f40: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 0x0aab2aaf7f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0aab2aaf7f60: 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 0x0aab2aaf7f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0aab2aaf7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==633279==ABORTING Program received signal SIGABRT, Aborted. --Type <RET> for more, q to quit, c to continue without paging-- 0x00007ffff5c09355 in raise () from /usr/lib/libc.so.6 (gdb)
Actions