Harald Welte has submitted this change and it was merged.
Change subject: RSL: Ensure we don't accept DCHAN messages for CCHAN
......................................................................
RSL: Ensure we don't accept DCHAN messages for CCHAN
If the Channel Number IE points to a common channel, we cannot
accept such messages in code paths that only process dedicated
channels, such as RLL/DCHAN/IPA.
Related: OS#2972, OS#2971
Change-Id: I43a78bec63aeb36dd67043d237b27fe880209349
---
M src/common/rsl.c
1 file changed, 22 insertions(+), 0 deletions(-)
Approvals:
Harald Welte: Looks good to me, approved
Jenkins Builder: Verified
diff --git a/src/common/rsl.c b/src/common/rsl.c
index 877f5d8..001d7e0 100644
--- a/src/common/rsl.c
+++ b/src/common/rsl.c
@@ -135,6 +135,16 @@
* support
*/
+/* Is this channel number for a dedicated channel (true) or not (false) */
+static bool chan_nr_is_dchan(uint8_t chan_nr)
+{
+ /* See TS 48.058 9.3.1 */
+ if (chan_nr & 0x80)
+ return false;
+ else
+ return true;
+}
+
static struct gsm_lchan *lchan_lookup(struct gsm_bts_trx *trx, uint8_t chan_nr,
const char *log_name)
{
@@ -2254,6 +2264,9 @@
}
msg->l3h = (unsigned char *)rh + sizeof(*rh);
+ if (!chan_nr_is_dchan(rh->chan_nr))
+ return rsl_reject_unknown_lchan(msg);
+
lchan = lchan_lookup(trx, rh->chan_nr, "RSL rx RLL: ");
if (!lchan) {
LOGP(DRLL, LOGL_NOTICE, "Rx RLL %s for unknown lchan\n",
@@ -2445,6 +2458,9 @@
}
msg->l3h = (unsigned char *)cch + sizeof(*cch);
+ if (chan_nr_is_dchan(cch->chan_nr))
+ return rsl_reject_unknown_lchan(msg);
+
msg->lchan = lchan_lookup(trx, cch->chan_nr, "RSL rx CCHAN: ");
if (!msg->lchan) {
LOGP(DRSL, LOGL_ERROR, "Rx RSL %s for unknown lchan\n",
@@ -2497,6 +2513,9 @@
return -EIO;
}
msg->l3h = (unsigned char *)dch + sizeof(*dch);
+
+ if (!chan_nr_is_dchan(dch->chan_nr))
+ return rsl_reject_unknown_lchan(msg);
msg->lchan = lchan_lookup(trx, dch->chan_nr, "RSL rx DCHAN: ");
if (!msg->lchan) {
@@ -2596,6 +2615,9 @@
}
msg->l3h = (unsigned char *)dch + sizeof(*dch);
+ if (!chan_nr_is_dchan(dch->chan_nr))
+ return rsl_reject_unknown_lchan(msg);
+
msg->lchan = lchan_lookup(trx, dch->chan_nr, "RSL rx IPACC: ");
if (!msg->lchan) {
LOGP(DRSL, LOGL_ERROR, "Rx RSL %s for unknow lchan\n",
--
To view, visit https://gerrit.osmocom.org/6635
To unsubscribe, visit https://gerrit.osmocom.org/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I43a78bec63aeb36dd67043d237b27fe880209349
Gerrit-PatchSet: 1
Gerrit-Project: osmo-bts
Gerrit-Branch: master
Gerrit-Owner: Harald Welte <lafo...@gnumonks.org>
Gerrit-Reviewer: Harald Welte <lafo...@gnumonks.org>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: Vadim Yanitskiy <axilira...@gmail.com>
