cellular-infrastructure
/
osmo-hnbgw
mirror of https://gerrit.osmocom.org/osmo-hnbgw
9
0
Fork 0
Code Issues Releases Wiki Activity

hnb_read_cb(): -EBADF must be returned if conn is freed to avoid use-after-free 

Otherwise the libosmo-netif stream API may continue accessing the conn
after returning if the socket has the WRITE flag active in the same main
loop iteration.

Change-Id: I628c59a88d94d299f432f405b37fbe602381d47e
This commit is contained in:
Pau Espin 2022-09-30 14:56:32 +02:00
parent c923d19b7b
commit bbad8dec36
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/osmo-hnbgw/hnbgw.c
View File

@ -264,7 +264,7 @@ static int hnb_read_cb(struct osmo_stream_srv *conn)
"sctp_recvmsg(%s) = SCTP_COMM_LOST, closing conn\n", "sctp_recvmsg(%s) = SCTP_COMM_LOST, closing conn\n",
osmo_sock_get_name2(ofd->fd)); osmo_sock_get_name2(ofd->fd));
osmo_stream_srv_destroy(conn); osmo_stream_srv_destroy(conn);
rc = -1; rc = -EBADF;
break; break;
case SCTP_RESTART: case SCTP_RESTART:
LOGHNB(hnb, DMAIN, LOGL_NOTICE, "HNB SCTP conn RESTARTed, marking as HNBAP-unregistered\n"); LOGHNB(hnb, DMAIN, LOGL_NOTICE, "HNB SCTP conn RESTARTed, marking as HNBAP-unregistered\n");
@ -277,7 +277,7 @@ static int hnb_read_cb(struct osmo_stream_srv *conn)
"sctp_recvmsg(%s) = SCTP_SHUTDOWN_EVENT, closing conn\n", "sctp_recvmsg(%s) = SCTP_SHUTDOWN_EVENT, closing conn\n",
osmo_sock_get_name2(ofd->fd)); osmo_sock_get_name2(ofd->fd));
osmo_stream_srv_destroy(conn); osmo_stream_srv_destroy(conn);
rc = -1; rc = -EBADF;
break; break;
} }
goto out; goto out;
@ -291,12 +291,13 @@ static int hnb_read_cb(struct osmo_stream_srv *conn)
LOGHNB(hnb, DMAIN, LOGL_ERROR, "Error during sctp_recvmsg(%s)\n", LOGHNB(hnb, DMAIN, LOGL_ERROR, "Error during sctp_recvmsg(%s)\n",
osmo_sock_get_name2(ofd->fd)); osmo_sock_get_name2(ofd->fd));
osmo_stream_srv_destroy(conn); osmo_stream_srv_destroy(conn);
rc = -EBADF;
goto out; goto out;
} else if (rc == 0) { } else if (rc == 0) {
LOGHNB(hnb, DMAIN, LOGL_NOTICE, "Connection closed sctp_recvmsg(%s) = 0\n", LOGHNB(hnb, DMAIN, LOGL_NOTICE, "Connection closed sctp_recvmsg(%s) = 0\n",
osmo_sock_get_name2(ofd->fd)); osmo_sock_get_name2(ofd->fd));
osmo_stream_srv_destroy(conn); osmo_stream_srv_destroy(conn);
rc = -1; rc = -EBADF;
goto out; goto out;
} else { } else {
msgb_put(msg, rc); msgb_put(msg, rc);