Neels Hofmeyr 28619961a9 fix segfault on MGCP timeout ... bisect shows that the segfault was introduced by using the MGCP client pool: e62af4d46a is the first bad commit Author: Pau Espin Pedrol <pespin@sysmocom.de> Introduce support for libosmo-mgcp-client MGW pooling Change-Id I371dc773b58788ee21037dc25d77f556c89c6b61 The segfault: 20230117224550365 DLMGCP DEBUG MGCP_CONN(to-HNB)[0x612000003ca0]{ST_CRCX_RESP}: Timeout of T1 (fsm.c:317) [...] 20230117224550366 DLMGCP DEBUG mgw-endp(mgw-fsm-14429752-0)[0x612000003b20]{WAIT_MGW_RESPONSE}: Deallocated (fsm.c:568) 20230117224550366 DMGW DEBUG mgw(mgw-fsm-14429752-0)[0x612000003820]{MGW_ST_CRCX_HNB}: Received Event MGW_EV_MGCP_TERM (mgcp_client_endpoint_fsm.c:869) ================================================================= ==255699==ERROR: AddressSanitizer: heap-use-after-free on address 0x62b000000260 at pc 0x7f282a6ee143 bp 0x7fff0d9bcae0 sp 0x7fff0d9bcad8 READ of size 8 at 0x62b000000260 thread T0 #0 0x7f282a6ee142 in osmo_mgcpc_ep_client ../../../../src/osmo-mgw/src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c:223 #1 0x55e2a84f1889 in mgw_fsm_allstate_action ../../../../src/osmo-hnbgw/src/osmo-hnbgw/mgw_fsm.c:504 #2 0x7f2829d50c56 in _osmo_fsm_inst_dispatch ../../../src/libosmocore/src/fsm.c:863 #3 0x7f2829d55a08 in _osmo_fsm_inst_term ../../../src/libosmocore/src/fsm.c:962 #4 0x7f282a72679a in osmo_mgcpc_ep_fsm_check_state_chg_after_response ../../../../src/osmo-mgw/src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c:869 #5 0x7f282a6f1869 in on_failure ../../../../src/osmo-mgw/src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c:414 #6 0x7f282a727ac6 in osmo_mgcpc_ep_fsm_handle_ci_events ../../../../src/osmo-mgw/src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c:935 [...] When a CRCX times out, MGCP_CONN fsm terminates (libosmo-mgcp-client). In turn the parent mgw-endp fsm terminates (libosmo-mgcp-client). This generates an MGW_EV_MGCP_TERM event to the mgw_fsm (osmo-ttcn3-hacks). This attempts to retrieve a pointer from mgw_fsm state: mgw_fsm_priv->mgcpc_ep->mgcp_client where the middle one, mgcpc_ep, is the 'mgw-endp' that already deallocated above. To fix, add to /osmo-hnbgw/mgw_fsm.c a separate pointer to the mgcp_client, to call mgcp_client_pool_put() on it. Do not use mgcpc_ep to get the mgcp_client, because mgcpc_ep deallocates independently. Related: OS#5862 Change-Id: I460d7249f4fc7edcfd94f6084fc8f933b491520c		2023-01-17 23:39:46 +01:00
..
osmo-hnbgw	fix segfault on MGCP timeout	2023-01-17 23:39:46 +01:00
Makefile.am	Initial structure + import code from osmo-iuh.git	2022-01-04 19:48:52 +01:00