[PATCH] osmo-bts[master]: RSL: Ensure we don't accept DCHAN messages for CCHAN

[Harald Welte]

Review at  https://gerrit.osmocom.org/6635

RSL: Ensure we don't accept DCHAN messages for CCHAN

If the Channel Number IE points to a common channel, we cannot
accept such messages in code paths that only process dedicated
channels, such as RLL/DCHAN/IPA.

Related: OS#2972, OS#2971
Change-Id: I43a78bec63aeb36dd67043d237b27fe880209349
---
M src/common/rsl.c
1 file changed, 22 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.osmocom.org:29418/osmo-bts refs/changes/35/6635/1

diff --git a/src/common/rsl.c b/src/common/rsl.c
index 877f5d8..001d7e0 100644
--- a/src/common/rsl.c
+++ b/src/common/rsl.c
@@ -135,6 +135,16 @@
  * support
  */
 
+/* Is this channel number for a dedicated channel (true) or not (false) */
+static bool chan_nr_is_dchan(uint8_t chan_nr)
+{
+	/* See TS 48.058 9.3.1 */
+	if (chan_nr & 0x80)
+		return false;
+	else
+		return true;
+}
+
 static struct gsm_lchan *lchan_lookup(struct gsm_bts_trx *trx, uint8_t chan_nr,
 				      const char *log_name)
 {
@@ -2254,6 +2264,9 @@
 	}
 	msg->l3h = (unsigned char *)rh + sizeof(*rh);
 
+	if (!chan_nr_is_dchan(rh->chan_nr))
+		return rsl_reject_unknown_lchan(msg);
+
 	lchan = lchan_lookup(trx, rh->chan_nr, "RSL rx RLL: ");
 	if (!lchan) {
 		LOGP(DRLL, LOGL_NOTICE, "Rx RLL %s for unknown lchan\n",
@@ -2445,6 +2458,9 @@
 	}
 	msg->l3h = (unsigned char *)cch + sizeof(*cch);
 
+	if (chan_nr_is_dchan(cch->chan_nr))
+		return rsl_reject_unknown_lchan(msg);
+
 	msg->lchan = lchan_lookup(trx, cch->chan_nr, "RSL rx CCHAN: ");
 	if (!msg->lchan) {
 		LOGP(DRSL, LOGL_ERROR, "Rx RSL %s for unknown lchan\n",
@@ -2497,6 +2513,9 @@
 		return -EIO;
 	}
 	msg->l3h = (unsigned char *)dch + sizeof(*dch);
+
+	if (!chan_nr_is_dchan(dch->chan_nr))
+		return rsl_reject_unknown_lchan(msg);
 
 	msg->lchan = lchan_lookup(trx, dch->chan_nr, "RSL rx DCHAN: ");
 	if (!msg->lchan) {
@@ -2596,6 +2615,9 @@
 	}
 	msg->l3h = (unsigned char *)dch + sizeof(*dch);
 
+	if (!chan_nr_is_dchan(dch->chan_nr))
+		return rsl_reject_unknown_lchan(msg);
+
 	msg->lchan = lchan_lookup(trx, dch->chan_nr, "RSL rx IPACC: ");
 	if (!msg->lchan) {
 		LOGP(DRSL, LOGL_ERROR, "Rx RSL %s for unknow lchan\n",

-- 
To view, visit https://gerrit.osmocom.org/6635
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I43a78bec63aeb36dd67043d237b27fe880209349
Gerrit-PatchSet: 1
Gerrit-Project: osmo-bts
Gerrit-Branch: master
Gerrit-Owner: Harald Welte <laforge at gnumonks.org>