abis_rsl: fix memleak in rach dos reduction function
The function reduce_rach_dos() only removes the tossed channel requests from the list, but does not free them. Change-Id: I0a62fc897c07e118dd637b156b6f2822c44db731 Related: OS#4549
This commit is contained in:
parent
3c6e86adce
commit
fcc5ffb96d
|
@ -1389,6 +1389,7 @@ static void reduce_rach_dos(struct gsm_bts *bts)
|
||||||
"(ra=0x%02x, neci=0x%02x, chreq_reason=0x%02x)\n",
|
"(ra=0x%02x, neci=0x%02x, chreq_reason=0x%02x)\n",
|
||||||
rqd->ref.ra, bts->network->neci, rqd->reason);
|
rqd->ref.ra, bts->network->neci, rqd->reason);
|
||||||
llist_del(&rqd->entry);
|
llist_del(&rqd->entry);
|
||||||
|
talloc_free(rqd);
|
||||||
} else {
|
} else {
|
||||||
rqd_count++;
|
rqd_count++;
|
||||||
}
|
}
|
||||||
|
@ -1398,7 +1399,9 @@ static void reduce_rach_dos(struct gsm_bts *bts)
|
||||||
* problem with RACH dos on this BTS. We drop the first entry in the list to clip the growth of the list. */
|
* problem with RACH dos on this BTS. We drop the first entry in the list to clip the growth of the list. */
|
||||||
if (rqd_count > 255) {
|
if (rqd_count > 255) {
|
||||||
LOG_BTS(bts, DRSL, LOGL_INFO, "CHAN RQD: more than 255 queued RACH requests -- RACH DoS attack?\n");
|
LOG_BTS(bts, DRSL, LOGL_INFO, "CHAN RQD: more than 255 queued RACH requests -- RACH DoS attack?\n");
|
||||||
llist_del(&llist_first_entry(&bts->chan_rqd_queue, struct chan_rqd, entry)->entry);
|
rqd = llist_first_entry(&bts->chan_rqd_queue, struct chan_rqd, entry);
|
||||||
|
llist_del(&rqd->entry);
|
||||||
|
talloc_free(rqd);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue