aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHarald Welte <laforge@osmocom.org>2020-07-04 10:52:13 +0200
committerHarald Welte <laforge@osmocom.org>2020-07-04 10:52:13 +0200
commitbc1d7152c1fa8050b4d5a93c5ef03eb017e1a444 (patch)
tree97114160bb24634e0acd8ca13c1293686f6e3b70
parent8617d09ee375c66b3aa2f6fe26c5b744b156c740 (diff)
lapd_core: After calling into L3, check if the state has changedlaforge/lapd
While processing an I-frame we may deliver its payload to L3. After returning from L3 procesing, we run some additional code, assuming the LAPD/DL state has not changed meanwhile. However, if the application destroys the LAPD/DL meanwhile, our state might be NULL again, and in this state we should not perform any further action. This is one of the cases where synchronous in-line dispatch across various layers is hitting us. L3 should have an input queue, and only start processing after all L2 work has completed and we're about to go back to sleep in select(). Change-Id: I026b64503511002c13c0f4117648c366c48ecc62 Related: OS#1761 Closes: OS#4646
-rw-r--r--src/gsm/lapd_core.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/src/gsm/lapd_core.c b/src/gsm/lapd_core.c
index cf25f3de..6a56572b 100644
--- a/src/gsm/lapd_core.c
+++ b/src/gsm/lapd_core.c
@@ -1578,6 +1578,10 @@ static int lapd_rx_i(struct msgb *msg, struct lapd_msg_ctx *lctx)
msgb_free(msg);
}
+ /* the L3 or higher (called in-line above via send_dl_l3) might have destroyed the
+ * data link meanwhile. See OS#1761 */
+ if (dl->state == LAPD_STATE_NULL)
+ return 0;
} else
LOGDL(dl, LOGL_INFO, "I frame ignored during own receiver busy condition\n");