Fix heap-use-after-free due to OML link destruction
ipaccess_drop_oml was being called inside an osmo_fd cb context, were -EBADF must be returned if the structure holding the osmo_fd is freed. In the middle of the path (see OS#3495 for path tree) it goes through a signal dispatch, so it's impossible to make sure we return some value to the osmo_fd cb. As a result, it is required to defer dropping the OML Link from current code path and do it through a timer. Fixes following ASan report: 20180822124927913 <0004> abis_nm.c:787 OC=RADIO-CARRIER(02) INST=(00,00,ff): CHANGE ADMINISTRATIVE STATE NACK CAUSE=Message cannot be performed 20180822124927913 <0004> osmo_bsc_main.c:186 Got CHANGE ADMINISTRATIVE STATE NACK going to drop the OML links. 20180822124927913 <0015> bts_ipaccess_nanobts.c:406 (bts=0) Dropping OML link. ... ================================================================= ==17607==ERROR: AddressSanitizer: heap-use-after-free on address 0x62e000060a68 at pc 0x7f5ea8e27086 bp 0x7ffde92b6d80 sp 0x7ffde92b6d78 READ of size 8 at 0x62e000060a68 thread T0 #0 0x7f5ea8e27085 in handle_ts1_write input/ipaccess.c:371 #1 0x7f5ea8e27085 in ipaccess_fd_cb input/ipaccess.c:391 #2 0x7f5ea9147ca8 in osmo_fd_disp_fds libosmocore/src/select.c:217 #3 0x7f5ea9147ca8 in osmo_select_main libosmocore/src/select.c:257 #4 0x555813ab79d6 in main osmo-bsc/osmo_bsc_main.c:922 #5 0x7f5ea76d02e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0) #6 0x555813ab84e9 in _start (/bin/osmo-bsc+0x34d4e9) Fixes: OS#3495 Change-Id: I7c794c763481c28e8c35dc9b11d27969e16feb3c
This commit is contained in:
parent
5f0a63d678
commit
9862bcb5cd
|
@ -923,6 +923,8 @@ struct gsm_bts {
|
|||
struct gsm_e1_subslot oml_e1_link;
|
||||
uint8_t oml_tei;
|
||||
struct e1inp_sign_link *oml_link;
|
||||
/* Timer to use for deferred drop of OML link, see \ref ipaccess_drop_oml_deferred */
|
||||
struct osmo_timer_list oml_drop_link_timer;
|
||||
/* when OML link was established */
|
||||
time_t uptime;
|
||||
|
||||
|
|
|
@ -31,6 +31,7 @@ struct ipac_ext_lac_cmd {
|
|||
} __attribute__((packed));
|
||||
|
||||
void ipaccess_drop_oml(struct gsm_bts *bts);
|
||||
void ipaccess_drop_oml_deferred(struct gsm_bts *bts);
|
||||
void ipaccess_drop_rsl(struct gsm_bts_trx *trx);
|
||||
|
||||
struct sdp_header_item {
|
||||
|
|
|
@ -166,7 +166,7 @@ static int nm_statechg_event(int evt, struct nm_statechg_signal_data *nsd)
|
|||
enum abis_nm_chan_comb ccomb =
|
||||
abis_nm_chcomb4pchan(ts->pchan_from_config);
|
||||
if (abis_nm_set_channel_attr(ts, ccomb) == -EINVAL) {
|
||||
ipaccess_drop_oml(trx->bts);
|
||||
ipaccess_drop_oml_deferred(trx->bts);
|
||||
return -1;
|
||||
}
|
||||
abis_nm_chg_adm_state(trx->bts, obj_class,
|
||||
|
@ -400,6 +400,9 @@ void ipaccess_drop_oml(struct gsm_bts *bts)
|
|||
struct gsm_bts *rdep_bts;
|
||||
struct gsm_bts_trx *trx;
|
||||
|
||||
/* First of all, remove deferred drop if enabled */
|
||||
osmo_timer_del(&bts->oml_drop_link_timer);
|
||||
|
||||
if (!bts->oml_link)
|
||||
return;
|
||||
|
||||
|
@ -432,6 +435,29 @@ void ipaccess_drop_oml(struct gsm_bts *bts)
|
|||
}
|
||||
}
|
||||
|
||||
/*! Callback for \ref ipaccess_drop_oml_deferred_cb.
|
||||
*/
|
||||
static void ipaccess_drop_oml_deferred_cb(void *data)
|
||||
{
|
||||
struct gsm_bts *bts = (struct gsm_bts *) data;
|
||||
ipaccess_drop_oml(bts);
|
||||
}
|
||||
/*! Deferr \ref ipacces_drop_oml through a timer to avoid dropping structures in
|
||||
* current code context. This may be needed if we want to destroy the OML link
|
||||
* while being called from a lower layer "struct osmo_fd" cb, were it is
|
||||
* mandatory to return -EBADF if the osmo_fd has been destroyed. In case code
|
||||
* destroying an OML link is called through an osmo_signal, it becomes
|
||||
* impossible to return any value, thus deferring the destruction is required.
|
||||
*/
|
||||
void ipaccess_drop_oml_deferred(struct gsm_bts *bts)
|
||||
{
|
||||
if (!osmo_timer_pending(&bts->oml_drop_link_timer) && bts->oml_link) {
|
||||
LOGP(DLINP, LOGL_NOTICE, "(bts=%d) Deferring Drop of OML link.\n", bts->nr);
|
||||
osmo_timer_setup(&bts->oml_drop_link_timer, ipaccess_drop_oml_deferred_cb, bts);
|
||||
osmo_timer_schedule(&bts->oml_drop_link_timer, 0, 0);
|
||||
}
|
||||
}
|
||||
|
||||
/* This function is called once the OML/RSL link becomes up. */
|
||||
static struct e1inp_sign_link *
|
||||
ipaccess_sign_link_up(void *unit_data, struct e1inp_line *line,
|
||||
|
|
|
@ -191,7 +191,7 @@ static int oml_msg_nack(struct nm_nack_signal_data *nack)
|
|||
}
|
||||
|
||||
if (is_ipaccess_bts(nack->bts))
|
||||
ipaccess_drop_oml(nack->bts);
|
||||
ipaccess_drop_oml_deferred(nack->bts);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue