diff options
| author | Pau Espin Pedrol <pespin@sysmocom.de> | 2020-10-19 16:38:25 +0200 |
|---|---|---|
| committer | laforge <laforge@osmocom.org> | 2020-10-19 15:06:55 +0000 |
| commit | 5ce54ba1e68ba2233f4d0cf94b12d6b4a3537399 (patch) | |
| tree | d82f48732a151cb0646b476c298fa503d0430168 | |
| parent | ff5b59a821f3211f422b676e89b9c4508134c839 (diff) | |
Fix crash rx DeactPdpReq while waiting for DeactPdpAck after gtp side is freed
Scenario:
1- For an unknwon reason, sgsn sends DeletePdpCtxReq on GTP towards GGSN.
2- GGSN answers with Error Indication to that pdp ctx which calls
gtp_freepdp()
3- gtp_freepdp() calls libgtp callback cb_delete_context() before freeing the
pointer, in osmo-sgsn callback points to cb_delete_context(), which
removes pctx->ggsn and tries to drop the pdp on the NS side by sending a
DeactPdpReq.
4- While waiting for DeactPdpAck, the MS/PCU sends a DeactPdpReq, and
code was unconditionalyl trying to release the gtp side without checking
if it was alreay released, using pctx->ggsn==NULL and crashing.
This is basically the same logic already in place in regular path
gsm48_rx_gsm_deact_pdp_ack.
Related: OS#4817
Change-Id: I02587a3dc812823d893fc00b904142b75fd190b9
| -rw-r--r-- | src/sgsn/gprs_sm.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/sgsn/gprs_sm.c b/src/sgsn/gprs_sm.c index f8019ab6..3bdad3bf 100644 --- a/src/sgsn/gprs_sm.c +++ b/src/sgsn/gprs_sm.c @@ -639,7 +639,11 @@ static int gsm48_rx_gsm_deact_pdp_req(struct sgsn_mm_ctx *mm, struct msgb *msg) return _gsm48_tx_gsm_deact_pdp_acc(mm, transaction_id); } - return sgsn_delete_pdp_ctx(pdp); + if (pdp->ggsn) + return sgsn_delete_pdp_ctx(pdp); + /* GTP side already detached, freeing */ + sgsn_pdp_ctx_free(pdp); + return 0; } /* 3GPP TS 24.008 ยง 9.5.9: Deactivate PDP Context Accept */ |