[PATCH 2/5] agch/rsl: Fix msgb handling for IMMEDIATE ASSIGN

Currently, the msg->data pointer is just set to the IMMEDIATE ASSIGN message and the len is adjusted accordingly. Unfortunately, this leaves l2h (pointing to the RSL header) and l3h (pointing to the FULL_IMM_ASS_INFO IE) in an undefined state (outside of [data, tail]). The code in bts.c accesses the message via msg->data. This patch sets l3h and l2h correctly. msgb_l3() will point to the start of the IMM ASS message and should be used instead of msg->data. Sponsored-by: On-Waves ehf --- src/common/rsl.c | 4 +++- src/osmo-bts-sysmo/l1_if.c | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/common/rsl.c b/src/common/rsl.c index 6a54612..821b1be 100644 --- a/src/common/rsl.c +++ b/src/common/rsl.c @@ -466,7 +466,9 @@ static int rsl_rx_imm_ass(struct gsm_bts_trx *trx, struct msgb *msg) return rsl_tx_error_report(trx, RSL_ERR_MAND_IE_ERROR); /* cut down msg to the 04.08 RR part */ - msg->data = (uint8_t *) TLVP_VAL(&tp, RSL_IE_FULL_IMM_ASS_INFO); + msg->l3h = (uint8_t *) TLVP_VAL(&tp, RSL_IE_FULL_IMM_ASS_INFO); + msg->data = msg->l3h; + msg->l2h = NULL; msg->len = TLVP_LEN(&tp, RSL_IE_FULL_IMM_ASS_INFO); /* put into the AGCH queue of the BTS */ diff --git a/src/osmo-bts-sysmo/l1_if.c b/src/osmo-bts-sysmo/l1_if.c index 3cd3be5..39c020b 100644 --- a/src/osmo-bts-sysmo/l1_if.c +++ b/src/osmo-bts-sysmo/l1_if.c @@ -519,7 +519,7 @@ static int handle_ph_readytosend_ind(struct femtol1_hdl *fl1, if (!msg) memcpy(msu_param->u8Buffer, fill_frame, GSM_MACBLOCK_LEN); else { - memcpy(msu_param->u8Buffer, msg->data, msg->len); + memcpy(msu_param->u8Buffer, msgb_l3(msg), msgb_l3len(msg)); msgb_free(msg); } } -- 1.7.9.5