Skip to content

Commit

Permalink
enb,s1ap: fix segfault when disconnected from MME
Browse files Browse the repository at this point in the history
If recv() fails and returns -1, we should not treat that as a received
PDU in any case, or we'll end up with N_bytes being 0xFFFFFFFF after
casting -1 as an unsigned integer.

So, if we detect disconnection and we successfully reconnect, fallback
to running recv() again right away.

    Thread 37 "S1AP" received signal SIGSEGV, Segmentation fault.
    [Switching to Thread 0x7fff9c879700 (LWP 11443)]
    0x000000000081d669 in liblte_value_2_bits (value=160, bits=0x7fff9c73ec30, N_bits=8) at /home/aleksander/srsLTE/lib/src/asn1/liblte_common.cc:64
    64	    (*bits)[i] = (value >> (N_bits - i - 1)) & 0x1;
    (gdb) bt
    #0  0x000000000081d669 in liblte_value_2_bits (value=160, bits=0x7fff9c73ec30, N_bits=8) at /home/aleksander/srsLTE/lib/src/asn1/liblte_common.cc:64
    srsran#1  0x000000000081d831 in liblte_unpack (bytes=0x148c7c80, bits=0x7fff9c73ec80) at /home/aleksander/srsLTE/lib/src/asn1/liblte_common.cc:118
    srsran#2  0x000000000087dee3 in liblte_s1ap_unpack_s1ap_pdu (msg=0x148c7c80, s1ap_pdu=0x7fff9c757f50) at /home/aleksander/srsLTE/lib/src/asn1/liblte_s1ap.cc:40300
    srsran#3  0x0000000000000000 in ?? ()

    (gdb) fr 2
    srsran#2  0x000000000087dee3 in liblte_s1ap_unpack_s1ap_pdu (msg=0x148c7c80, s1ap_pdu=0x7fff9c757f50) at /home/aleksander/srsLTE/lib/src/asn1/liblte_s1ap.cc:40300
    40300	    liblte_unpack(msg, &bit_msg);

    (gdb) p *msg
    $22 = {N_bytes = 4294967295, header = '\000' <repeats 1019 times>, msg = '\000' <repeats 12240 times>...}
  • Loading branch information
aleksander0m committed Nov 14, 2019
1 parent c8a4d53 commit 685efa1
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions srsenb/src/stack/upper/s1ap.cc
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,7 @@ void s1ap::run_thread()
running = false;
return;
}
continue;
}

pdu->N_bytes = static_cast<uint32_t>(n_recv);
Expand Down

0 comments on commit 685efa1

Please sign in to comment.