9 Feb
2018
9 Feb
'18
4:49 p.m.
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Osmocom BTS-side code (Abis, scheduling, ...)".
The branch, master has been updated
via 54be46949e93e07e9e57b706388ebb832e5fad0a (commit)
from 98f3f700797dcbf4777210c8100af79e27ffa7f1 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
http://cgit.osmocom.org/osmo-bts/commit/?id=54be46949e93e07e9e57b706388ebb8…
commit 54be46949e93e07e9e57b706388ebb832e5fad0a
Author: Pau Espin Pedrol <pespin(a)sysmocom.de>
Date: Fri Feb 9 12:08:38 2018 +0100
l1sap: Validate incoming RTP payload, drop bw-efficient AMR
A recurrent kernel crash in sysmobts (several kernel versions)
corrupting kernel memory in random places has been investigated and
reproduced by placing a call against an MSC sending RTP
with bandwidth-efficient AMR payload to osmo-bts-sysmo.
The osmo-bts-sysmo in turn sends the payload to the femtobts related
kernel modules via a msgq, which most probably fail to handle correctly
this bw-efficient AMR payload and corrupt the kernel memory.
First approach was to drop the bw-efficient AMR payloads lower in the
stack in sysmo specific code (l1if_tch_encode), but as there's no bts
model in osmo-bts actually supporting bw-efficient AMR, let's drop it
early in the incoming path for all models to avoid further problems.
Related: SYS#4063
Change-Id: If0c9233c628c724de4ab74e58e3e2affac79e6d0
-----------------------------------------------------------------------
Summary of changes:
src/common/l1sap.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 45 insertions(+)
hooks/post-receive
--
Osmocom BTS-side code (Abis, scheduling, ...)