From f2c11fc438ae6949f59457d61b518a0e077bbc26 Mon Sep 17 00:00:00 2001 From: okabetakayuki Date: Thu, 9 Nov 2023 11:05:08 +0000 Subject: [PATCH 1/2] fix DoS vulnerability of RA procedure Signed-off-by: okabetakayuki --- openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_primitives.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_primitives.c b/openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_primitives.c index d72339c11f..88052763f9 100644 --- a/openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_primitives.c +++ b/openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_primitives.c @@ -2905,7 +2905,15 @@ void nr_mac_update_timers(module_id_t module_id, UE->ra_timer--; if (UE->ra_timer == 0) { LOG_W(NR_MAC, "Removing UE %04x because RA timer expired\n", UE->rnti); + const rnti_t rnti = UE->rnti; mac_remove_nr_ue(mac, UE->rnti); + NR_COMMON_channels_t *cc = &mac->common_channels[0]; + for (int i = 0; i < NR_NB_RA_PROC_MAX; i++) { + if (cc->ra[i].rnti == rnti) { + LOG_E(NR_MAC, "free RA process %d for rnti %04x\n", i, rnti); + nr_clear_ra_proc(module_id, 0, frame, &cc->ra[i]); + } + } } } } From 398bdce1e2d7e30916528e47e3731b7e3727cf54 Mon Sep 17 00:00:00 2001 From: Robert Schmidt Date: Mon, 18 Dec 2023 11:10:13 +0100 Subject: [PATCH 2/2] Reuse variable, remove error message, do not skip UE --- openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_primitives.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_primitives.c b/openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_primitives.c index 88052763f9..bae9f71b61 100644 --- a/openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_primitives.c +++ b/openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_primitives.c @@ -2904,16 +2904,17 @@ void nr_mac_update_timers(module_id_t module_id, if (UE->ra_timer > 0) { UE->ra_timer--; if (UE->ra_timer == 0) { - LOG_W(NR_MAC, "Removing UE %04x because RA timer expired\n", UE->rnti); const rnti_t rnti = UE->rnti; - mac_remove_nr_ue(mac, UE->rnti); + LOG_W(NR_MAC, "Removing UE %04x because RA timer expired\n", rnti); + mac_remove_nr_ue(mac, rnti); NR_COMMON_channels_t *cc = &mac->common_channels[0]; for (int i = 0; i < NR_NB_RA_PROC_MAX; i++) { if (cc->ra[i].rnti == rnti) { - LOG_E(NR_MAC, "free RA process %d for rnti %04x\n", i, rnti); nr_clear_ra_proc(module_id, 0, frame, &cc->ra[i]); } } + // don't skip a UE, current UE does not exist anymore + UE--; } } }