we've seen a heap-buffer overflow in fmt because printf wasn't using
the right formtter for size_t, which should be %zu
this patch fixes it for the PDCP LTE entity but we might have it elsewhere too
[1m[31m==7595==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x629000e6f1fc at pc 0x562273a45289 bp 0x7f35567641f0 sp 0x7f35567641e0
[1m[0m[1m[34mREAD of size 4 at 0x629000e6f1fc thread T12 (STACK)[1m[0m
0 0x562273a45288 in fmt::v7::basic_format_arg<fmt::v7::basic_printf_context<std::back_insert_iterator<fmt::v7::detail::buffer<char> >, char> > fmt::v7::detail::make_arg<fmt::v7::basic_printf_context<std::back_insert_iterator<fmt::v7::detail::buffer<char> >, char>, unsigned int>(unsigned int const&) (/osmo-gsm-tester-srsue/srslte/bin/srsue+0x9dc288)
1 0x562273a3aa86 in void fmt::v7::dynamic_format_arg_store<fmt::v7::basic_printf_context<std::back_insert_iterator<fmt::v7::detail::buffer<char> >, char> >::emplace_arg<unsigned int>(unsigned int const&) (/osmo-gsm-tester-srsue/srslte/bin/srsue+0x9d1a86)
2 0x562273a308e7 in void fmt::v7::dynamic_format_arg_store<fmt::v7::basic_printf_context<std::back_insert_iterator<fmt::v7::detail::buffer<char> >, char> >::push_back<unsigned int>(unsigned int const&) /mnt/data/jenkins/workspace/srslte_ogt_trial_builder_x86-ubuntu1804-asan/srsLTE/lib/include/srslte/srslog/bundled/fmt/core.h:1548
3 0x562274361541 in void srslog::log_channel::operator()<unsigned int&, unsigned int&, unsigned long>(char const*, unsigned int&, unsigned int&, unsigned long&&) /mnt/data/jenkins/workspace/srslte_ogt_trial_builder_x86-ubuntu1804-asan/srsLTE/lib/include/srslte/srslog/log_channel.h:101
4 0x56227430d9e7 in srslte::pdcp_entity_lte::update_rx_counts_queue(unsigned int) /mnt/data/jenkins/workspace/srslte_ogt_trial_builder_x86-ubuntu1804-asan/srsLTE/lib/src/upper/pdcp_entity_lte.cc:451
the patch refactor the logging when a new PDCP SDU is enqueued for
transmission at RLC.
If the SN is already present, only a warning is logged. From the RLC
perspective operation continues and the SDU will be transmitted.
The patch also changes the order of logs. When the SN cannot be inserted
inside the queue of undelivered SDUs, only one message is logged.
Some bug fixes had to be solved:
- the cfi cannot be dynamic once we set a SIB/paging/RAR allocation. This is too avoid effective coderate to exceed its maximum
- the previous bugfix required adding the feature to cancel the last PDCCH+PDSCH allocation
since the tests are random we sometimes hit the maxRetx threshold
with 8 retx allowed that made the unit test fail.
increase threshold to lower the likelihood for this to happen.
Francisco
Ismael Gomez
David Rupprecht
Pedro Alvarez
Xavier Arteaga
Andre Puschmann
faluco