Merge remote-tracking branch 'origin/zecke/lapd-fixes'

4 files changed, 40 insertions, 13 deletions

diff --git a/src/gsm/lapd_core.c b/src/gsm/lapd_core.c
index b1b5a1ba..fb79a2f0 100644
--- a/src/gsm/lapd_core.c
+++ b/src/gsm/lapd_core.c
@@ -1731,7 +1731,15 @@ static int lapd_data_req(struct osmo_dlsap_prim *dp, struct lapd_msg_ctx *lctx)
 	struct lapd_datalink *dl = lctx->dl;
 	struct msgb *msg = dp->oph.msg;
 
-	LOGP(DLLAPD, LOGL_INFO, "writing message to send-queue\n");
+	if (msgb_l3len(msg) == 0) {
+		LOGP(DLLAPD, LOGL_ERROR,
+			"writing an empty message is not possible.\n");
+		msgb_free(msg);
+		return -1;
+	}
+
+	LOGP(DLLAPD, LOGL_INFO,
+	     "writing message to send-queue: l3len: %d\n", msgb_l3len(msg));
 
 	/* Write data into the send queue */
 	msgb_enqueue(&dl->send_queue, msg);
diff --git a/src/gsm/lapdm.c b/src/gsm/lapdm.c
index 3d2f3d83..e9ce881b 100644
--- a/src/gsm/lapdm.c
+++ b/src/gsm/lapdm.c
@@ -792,7 +792,7 @@ static int rslms_rx_rll_est_req(struct msgb *msg, struct lapdm_datalink *dl)
 	/* Remove RLL header from msgb and set length to L3-info */
 	msgb_pull_l2h(msg);
 	msg->len = length;
-	msg->tail = msg->data + length;
+	msg->tail = msg->l3h + length;
 
 	/* prepare prim */
 	osmo_prim_init(&dp.oph, 0, PRIM_DL_EST, PRIM_OP_REQUEST, msg);
@@ -845,7 +845,7 @@ static int rslms_rx_rll_udata_req(struct msgb *msg, struct lapdm_datalink *dl)
 	/* Remove RLL header from msgb and set length to L3-info */
 	msgb_pull_l2h(msg);
 	msg->len = length;
-	msg->tail = msg->data + length;
+	msg->tail = msg->l3h + length;
 
 	/* Push L1 + LAPDm header on msgb */
 	msg->l2h = msgb_push(msg, 4 + !ui_bts);
@@ -881,7 +881,7 @@ static int rslms_rx_rll_data_req(struct msgb *msg, struct lapdm_datalink *dl)
 	/* Remove RLL header from msgb and set length to L3-info */
 	msgb_pull_l2h(msg);
 	msg->len = length;
-	msg->tail = msg->data + length;
+	msg->tail = msg->l3h + length;
 
 	/* prepare prim */
 	osmo_prim_init(&dp.oph, 0, PRIM_DL_DATA, PRIM_OP_REQUEST, msg);
@@ -938,7 +938,7 @@ static int rslms_rx_rll_res_req(struct msgb *msg, struct lapdm_datalink *dl)
 	/* Remove RLL header from msgb and set length to L3-info */
 	msgb_pull_l2h(msg);
 	msg->len = length;
-	msg->tail = msg->data + length;
+	msg->tail = msg->l3h + length;
 
 	/* prepare prim */
 	osmo_prim_init(&dp.oph, 0, (msg_type == RSL_MT_RES_REQ) ? PRIM_DL_RES
diff --git a/tests/lapd/lapd_test.c b/tests/lapd/lapd_test.c
index 8c6b0df2..d58bec65 100644
--- a/tests/lapd/lapd_test.c
+++ b/tests/lapd/lapd_test.c
@@ -73,8 +73,8 @@ static const uint8_t cm_padded[] = {
 };
 
 static const uint8_t mm[] = {
-	0x05, 0x24, 0x31, 0x03, 0x50, 0x18, 0x93, 0x08,
-	0x29, 0x47, 0x80, 0x00,
+	0x00, 0x0c, 0x00, 0x03, 0x01, 0x01, 0x20, 0x02,
+	0x00, 0x0b, 0x00, 0x03, 0x05, 0x04, 0x0d
 };
 
 static const uint8_t dummy1[] = {
@@ -95,6 +95,20 @@ static struct msgb *create_mm_id_req(void)
 	struct msgb *msg;
 
 	msg = msgb_from_array(mm, sizeof(mm));
+	msg->l2h = msg->data + 3;
+	ASSERT(msgb_l2len(msg) == 12);
+	msg->l3h = msg->l2h + 6;
+	ASSERT(msgb_l3len(msg) == 6);
+
+	return msg;
+}
+
+static struct msgb *create_empty_msg(void)
+{
+	struct msgb *msg;
+
+	msg = msgb_from_array(NULL, 0);
+	ASSERT(msgb_l3len(msg) == 0);
 	rsl_rll_push_l3(msg, RSL_MT_DATA_REQ, 0, 0, 1);
 	return msg;
 }
@@ -194,9 +208,9 @@ static int ms_to_bts_tx_cb(struct msgb *msg, struct lapdm_entity *le, void *_ctx
 		/* ASSERT(msg->data[7] == 0x0 && msg->data[8] == 0x9c); */
 		/* this should be 0x0 and 0x0... but we have a bug */
 	} else if (state->ms_read == 1) {
-		printf("MS: Verifying incoming MM message.\n");
-		ASSERT(msgb_l3len(msg) == ARRAY_SIZE(mm));
-		ASSERT(memcmp(msg->l3h, mm, msgb_l3len(msg)) == 0);
+		printf("MS: Verifying incoming MM message: %d\n", msgb_l3len(msg));
+		ASSERT(msgb_l3len(msg) == 3);
+		ASSERT(memcmp(msg->l3h, &mm[12], msgb_l3len(msg)) == 0);
 	} else {
 		printf("MS: Do not know to verify: %d\n", state->ms_read);
 	}
@@ -271,7 +285,7 @@ static void test_lapdm_polling()
 	lapdm_rslms_recvmsg(create_dummy_data_req(), &ms_to_bts_channel);
 
 
-	/* 4. And back to the MS */
+	/* 4. And back to the MS, but let's move data/l2h apart */
 	ASSERT(test_state.bts_read == 2)
 	ASSERT(test_state.ms_read == 2);
 	rc = lapdm_phsap_dequeue_prim(&bts_to_ms_channel.lapdm_dcch, &pp);
@@ -284,6 +298,11 @@ static void test_lapdm_polling()
 	rc = lapdm_phsap_dequeue_prim(&bts_to_ms_channel.lapdm_dcch, &pp);
 	ASSERT(rc < 0);
 
+	/* check sending an empty L3 message fails */
+	rc = lapdm_rslms_recvmsg(create_empty_msg(), &bts_to_ms_channel);
+	ASSERT(rc == -1);
+	ASSERT(test_state.ms_read == 2);
+
 	/* clean up */
 	lapdm_channel_exit(&bts_to_ms_channel);
 	lapdm_channel_exit(&ms_to_bts_channel);
diff --git a/tests/lapd/lapd_test.ok b/tests/lapd/lapd_test.ok
index 058ac3d7..d67a0a80 100644
--- a/tests/lapd/lapd_test.ok
+++ b/tests/lapd/lapd_test.ok
@@ -9,8 +9,8 @@ ms_to_bts_tx_cb: BTS->MS(us) message 9
 MS: Verifying incoming primitive.
 
 Sending back to MS
-ms_to_bts_tx_cb: BTS->MS(us) message 21
-MS: Verifying incoming MM message.
+ms_to_bts_tx_cb: BTS->MS(us) message 12
+MS: Verifying incoming MM message: 3
 ms_to_bts_l1_cb: MS(us) -> BTS prim message
 
 Sending back to BTS