From 8b67202ef6725a0292e878a4625ad634261abd69 Mon Sep 17 00:00:00 2001 From: Pau Espin Pedrol Date: Thu, 22 Nov 2018 17:25:49 +0100 Subject: gbproxy: Fix abort during APN patch gbproxy process was aborted with following message during APN patching: <000e> gb_proxy_patch.c:129 Patching ACT_PDP_REQ to SGSN: Replacing APN 'foo' -> 'bar' msgb(0x5555558797d0): Sub area is not fully contained in the msg data During osmo-sgsn 107fb59e84b12bbf6bdfdd4fc241dbcda7332706 old copy of gprs_msgb_resize_area was replaced by more modern libosmocore version called msgb_resize_area. They are mostly identical but the later has some extra verification asserts. One of this asserts was triggering the process abort, but the bug has always been there as far as I could see in git history. The assert triggers because the bssgp buffer and parse_ctx point to "stored_msg", while the data buffer comes from a different msbg "msg", which is clearly wrong behavior. In the modified line, "msg" (the one which provided the imsi now already stored in link_info through gbproxy_update_link_state_ul()->gbproxy_assign_imsi()) is really not needed anymore, and we want to patch the stored msg going to be forwarded. Related: SYS#4397 Change-Id: I7226fc5bcfbf58c349431d0a39cdb904fefd9e9c --- src/gprs/gb_proxy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gprs/gb_proxy.c b/src/gprs/gb_proxy.c index fe6a6c64f..85c3c4704 100644 --- a/src/gprs/gb_proxy.c +++ b/src/gprs/gb_proxy.c @@ -348,7 +348,7 @@ static int gbproxy_flush_stored_messages(struct gbproxy_peer *peer, gprs_gb_parse_bssgp(msgb_bssgph(stored_msg), msgb_bssgp_len(stored_msg), &tmp_parse_ctx); - gbproxy_patch_bssgp(msg, msgb_bssgph(stored_msg), + gbproxy_patch_bssgp(stored_msg, msgb_bssgph(stored_msg), msgb_bssgp_len(stored_msg), peer, link_info, &len_change, &tmp_parse_ctx); -- cgit v1.2.3