osmo-bts-trx error with tch/h

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/OpenBSC@lists.osmocom.org/.

Vadim Yanitskiy axilirator at gmail.com
Fri Feb 10 11:00:03 UTC 2017


> Is this also covered in gerrit review for some of your patches like 933
> or 1628?

Yeah, it's covered by https://gerrit.osmocom.org/#/c/933/ , and this is
exactly the reason, why the change isn't ready to merge yet :(


Well, some more details:
# valgrind --track-origins=yes tests/coding/.libs/lt-coding_test

==27652== Memcheck, a memory error detector
==27652== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==27652== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==27652== Command: tests/coding/.libs/lt-coding_test
==27652==
xcch_decode: n_errors=60 n_bits_total=456 ber=0.13
xcch_decode: n_errors=60 n_bits_total=456 ber=0.13
xcch_decode: n_errors=60 n_bits_total=456 ber=0.13
tch_fr_decode: n_errors=8 n_bits_total=378 ber=0.02
tch_fr_decode: n_errors=8 n_bits_total=378 ber=0.02
tch_fr_decode: n_errors=10 n_bits_total=456 ber=0.02
tch_fr_decode: n_errors=10 n_bits_total=456 ber=0.02
tch_fr_decode: n_errors=10 n_bits_total=456 ber=0.02
==27652== Conditional jump or move depends on uninitialised value(s)
==27652==    at 0x400F49: ubits2sbits (coding_test.c:48)
==27652==    by 0x401416: test_hr (coding_test.c:290)
==27652==    by 0x400D62: main (coding_test.c:486)
==27652==  Uninitialised value was created by a stack allocation
==27652==    at 0x4E402ED: gsm0503_tch_hr_encode (gsm0503_coding.c:1839)
==27652==
==27652== Conditional jump or move depends on uninitialised value(s)
==27652==    at 0x400F4E: ubits2sbits (coding_test.c:54)
==27652==    by 0x401416: test_hr (coding_test.c:290)
==27652==    by 0x400D62: main (coding_test.c:486)
==27652==  Uninitialised value was created by a stack allocation
==27652==    at 0x4E402ED: gsm0503_tch_hr_encode (gsm0503_coding.c:1839)
==27652==
==27652== Conditional jump or move depends on uninitialised value(s)
==27652==    at 0x5422CCE: osmo_conv_decode_scan (conv.c:394)
==27652==    by 0x54231E8: osmo_conv_decode (conv.c:616)
==27652==    by 0x4E3D677: osmo_conv_decode_ber (gsm0503_coding.c:469)
==27652==    by 0x4E3FFCD: gsm0503_tch_hr_decode (gsm0503_coding.c:1818)
==27652==    by 0x40144A: test_hr (coding_test.c:336)
==27652==    by 0x400D62: main (coding_test.c:486)
==27652==  Uninitialised value was created by a stack allocation
==27652==    at 0x4E3FF30: gsm0503_tch_hr_decode (gsm0503_coding.c:1763)
==27652==
==27652== Conditional jump or move depends on uninitialised value(s)
==27652==    at 0x5422D08: osmo_conv_decode_scan (conv.c:403)
==27652==    by 0x54231E8: osmo_conv_decode (conv.c:616)
==27652==    by 0x4E3D677: osmo_conv_decode_ber (gsm0503_coding.c:469)
==27652==    by 0x4E3FFCD: gsm0503_tch_hr_decode (gsm0503_coding.c:1818)
==27652==    by 0x40144A: test_hr (coding_test.c:336)
==27652==    by 0x400D62: main (coding_test.c:486)
==27652==  Uninitialised value was created by a stack allocation
==27652==    at 0x4E3FF30: gsm0503_tch_hr_decode (gsm0503_coding.c:1763)
==27652==
==27652== Conditional jump or move depends on uninitialised value(s)
==27652==    at 0x5422F91: osmo_conv_decode_flush (conv.c:509)
==27652==    by 0x5423235: osmo_conv_decode (conv.c:619)
==27652==    by 0x4E3D677: osmo_conv_decode_ber (gsm0503_coding.c:469)
==27652==    by 0x4E3FFCD: gsm0503_tch_hr_decode (gsm0503_coding.c:1818)
==27652==    by 0x40144A: test_hr (coding_test.c:336)
==27652==    by 0x400D62: main (coding_test.c:486)
==27652==  Uninitialised value was created by a stack allocation
==27652==    at 0x4E3FF30: gsm0503_tch_hr_decode (gsm0503_coding.c:1763)
==27652==
==27652== Conditional jump or move depends on uninitialised value(s)
==27652==    at 0x4E3D72C: osmo_conv_decode_ber (gsm0503_coding.c:480)
==27652==    by 0x4E3FFCD: gsm0503_tch_hr_decode (gsm0503_coding.c:1818)
==27652==    by 0x40144A: test_hr (coding_test.c:336)
==27652==    by 0x400D62: main (coding_test.c:486)
==27652==  Uninitialised value was created by a stack allocation
==27652==    at 0x4E3FF30: gsm0503_tch_hr_decode (gsm0503_coding.c:1763)
==27652==
tch_hr_decode: n_errors=11 n_bits_total=211 ber=0.05
tch_hr_decode: n_errors=10 n_bits_total=456 ber=0.02
tch_hr_decode: n_errors=10 n_bits_total=456 ber=0.02
tch_hr_decode: n_errors=10 n_bits_total=456 ber=0.02
pdtch_decode: n_errors=0 n_bits_total=456 ber=0.00
pdtch_decode: n_errors=132 n_bits_total=588 ber=0.22
pdtch_decode: n_errors=220 n_bits_total=676 ber=0.33
pdtch_decode: n_errors=0 n_bits_total=444 ber=0.00
pdtch_decode: n_errors=0 n_bits_total=456 ber=0.00
pdtch_decode: n_errors=132 n_bits_total=588 ber=0.22
pdtch_decode: n_errors=220 n_bits_total=676 ber=0.33
pdtch_decode: n_errors=0 n_bits_total=444 ber=0.00
Success
==27652==
==27652== HEAP SUMMARY:
==27652==     in use at exit: 0 bytes in 0 blocks
==27652==   total heap usage: 2,367 allocs, 2,367 frees, 397,488 bytes
allocated
==27652==
==27652== All heap blocks were freed -- no leaks are possible
==27652==
==27652== For counts of detected and suppressed errors, rerun with: -v
==27652== ERROR SUMMARY: 7041 errors from 6 contexts (suppressed: 0 from 0)

I paid my attention on the "Uninitialised value was created by a stack
allocation" warning, and merely used memset() to fill some arrays by 0x00
in the gsm0503_tch_hr_decode(). And... it was the first time when I got
successful build on Jenkins! This is the temporary solution:

sbit_t iB[912], cB[456], h;
ubit_t conv[98], b[112], d[112], p[3];
int i, rv, steal = 0;

/**
 * Fix valgrind warnings:
 * "Uninitialised value was created by a stack allocation"
 * "Conditional jump or move depends on uninitialised value(s)"
 */
memset(iB, 0x00, sizeof(iB));

Then I started to dig deeper into the code, and used memset()
one more time: http://pastebin.com/jBJT3q6R

This dirty printf based debug led me closer to the problem. We are getting
different results (successes and fails) because the gsm0503_tch_burst_map()
refers to uninitialized value at iB[353].

Now we need to find out, where is the bug. There are two assumptions:

1) The gsm0503_tch_hr_interleave() doesn't initialize the iB[353];
2) The gsm0503_tch_burst_map() refers to the value which it shouldn't
   refer to.


With best regards,
Vadim Yanitskiy.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/openbsc/attachments/20170210/5e4f5b8e/attachment.htm>


More information about the OpenBSC mailing list