[PATCH] osmo-bts[master]: Check return value to prevent crash

[Max]

Review at  https://gerrit.osmocom.org/3878

Check return value to prevent crash

Previously result of readv() was used unconditionally so when it failed
and returned negative value it was treated like very large positive
which lead to memory corruption.

Change-Id: I956c8d551f45c9dd43b5e9de11dfe20dd8783647
Related: SYS#3865
---
M src/osmo-bts-litecell15/l1_transp_hw.c
M src/osmo-bts-sysmo/l1_transp_hw.c
2 files changed, 12 insertions(+), 2 deletions(-)


  git pull ssh://gerrit.osmocom.org:29418/osmo-bts refs/changes/78/3878/1

diff --git a/src/osmo-bts-litecell15/l1_transp_hw.c b/src/osmo-bts-litecell15/l1_transp_hw.c
index 6381864..f349dd9 100644
--- a/src/osmo-bts-litecell15/l1_transp_hw.c
+++ b/src/osmo-bts-litecell15/l1_transp_hw.c
@@ -204,8 +204,13 @@
 		iov[i].iov_len = msgb_tailroom(msg[i]);
 	}
 
-
 	rc = readv(ofd->fd, iov, ARRAY_SIZE(iov));
+	if (rc < 0) {
+		for (i = count; i < ARRAY_SIZE(iov); ++i)
+			msgb_free(msg[i]);
+		return 0;
+	}
+
 	count = rc / prim_size;
 
 	for (i = 0; i < count; ++i) {
diff --git a/src/osmo-bts-sysmo/l1_transp_hw.c b/src/osmo-bts-sysmo/l1_transp_hw.c
index da8ac3f..7903c94 100644
--- a/src/osmo-bts-sysmo/l1_transp_hw.c
+++ b/src/osmo-bts-sysmo/l1_transp_hw.c
@@ -215,8 +215,13 @@
 		iov[i].iov_len = msgb_tailroom(msg[i]);
 	}
 
-
 	rc = readv(ofd->fd, iov, ARRAY_SIZE(iov));
+	if (rc < 0) {
+		for (i = count; i < ARRAY_SIZE(iov); ++i)
+			msgb_free(msg[i]);
+		return 0;
+	}
+
 	count = rc / prim_size;
 
 	for (i = 0; i < count; ++i) {

-- 
To view, visit https://gerrit.osmocom.org/3878
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I956c8d551f45c9dd43b5e9de11dfe20dd8783647
Gerrit-PatchSet: 1
Gerrit-Project: osmo-bts
Gerrit-Branch: master
Gerrit-Owner: Max <msuraev at sysmocom.de>