cellular-infrastructure
/
osmo-hnbgw
mirror of https://gerrit.osmocom.org/osmo-hnbgw
9
0
Fork 0
Code Issues Releases Wiki Activity
osmo-hnbgw/src/osmo-hnbgw
History
Neels Hofmeyr 28619961a9 fix segfault on MGCP timeout 
bisect shows that the segfault was introduced by using the MGCP client
pool:

 e62af4d46a is the first bad commit
 Author: Pau Espin Pedrol <pespin@sysmocom.de>
    Introduce support for libosmo-mgcp-client MGW pooling
    Change-Id I371dc773b58788ee21037dc25d77f556c89c6b61

The segfault:

 20230117224550365 DLMGCP DEBUG MGCP_CONN(to-HNB)[0x612000003ca0]{ST_CRCX_RESP}: Timeout of T1 (fsm.c:317)
 [...]
 20230117224550366 DLMGCP DEBUG mgw-endp(mgw-fsm-14429752-0)[0x612000003b20]{WAIT_MGW_RESPONSE}: Deallocated (fsm.c:568)
 20230117224550366 DMGW DEBUG mgw(mgw-fsm-14429752-0)[0x612000003820]{MGW_ST_CRCX_HNB}: Received Event MGW_EV_MGCP_TERM (mgcp_client_endpoint_fsm.c:869)
 =================================================================
 ==255699==ERROR: AddressSanitizer: heap-use-after-free on address 0x62b000000260 at pc 0x7f282a6ee143 bp 0x7fff0d9bcae0 sp 0x7fff0d9bcad8
 READ of size 8 at 0x62b000000260 thread T0
     #0 0x7f282a6ee142 in osmo_mgcpc_ep_client ../../../../src/osmo-mgw/src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c:223
     #1 0x55e2a84f1889 in mgw_fsm_allstate_action ../../../../src/osmo-hnbgw/src/osmo-hnbgw/mgw_fsm.c:504
     #2 0x7f2829d50c56 in _osmo_fsm_inst_dispatch ../../../src/libosmocore/src/fsm.c:863
     #3 0x7f2829d55a08 in _osmo_fsm_inst_term ../../../src/libosmocore/src/fsm.c:962
     #4 0x7f282a72679a in osmo_mgcpc_ep_fsm_check_state_chg_after_response ../../../../src/osmo-mgw/src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c:869
     #5 0x7f282a6f1869 in on_failure ../../../../src/osmo-mgw/src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c:414
     #6 0x7f282a727ac6 in osmo_mgcpc_ep_fsm_handle_ci_events ../../../../src/osmo-mgw/src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c:935
 [...]

When a CRCX times out, MGCP_CONN fsm terminates (libosmo-mgcp-client).
In turn the parent mgw-endp fsm terminates (libosmo-mgcp-client).
This generates an MGW_EV_MGCP_TERM event to the mgw_fsm (osmo-ttcn3-hacks).
This attempts to retrieve a pointer from mgw_fsm state:
mgw_fsm_priv->mgcpc_ep->mgcp_client
where the middle one, mgcpc_ep, is the 'mgw-endp' that already deallocated above.

To fix, add to /osmo-hnbgw/mgw_fsm.c a separate pointer to the
mgcp_client, to call mgcp_client_pool_put() on it. Do not use mgcpc_ep
to get the mgcp_client, because mgcpc_ep deallocates independently.

Related: OS#5862
Change-Id: I460d7249f4fc7edcfd94f6084fc8f933b491520c
 		2023-01-17 23:39:46 +01:00
..
Makefile.am Makefile.am: Drop duplicated LIBOSMOMGCPCLIENT_LIBS 2022-10-19 15:56:52 +02:00
context_map.c context_map: Lower loglevel to INFO when deallocating context IDs 2022-12-23 15:23:00 +00:00
hnbgw.c osmo-hnbgw: Transition to use of 'telnet_init_default' 2022-12-23 11:13:46 +00:00
hnbgw_cn.c optimize: decode PS msgs only when PFCP is enabled 2022-08-17 14:33:33 +00:00
hnbgw_hnbap.c Workaround bug where old hnb_context from same remote addr+port is kept 2022-09-29 17:18:56 +02:00
hnbgw_pfcp.c add ps_rab_ass FSM to map GTP via UPF 2022-08-08 20:20:34 +00:00
hnbgw_ranap.c Initial structure + import code from osmo-iuh.git 2022-01-04 19:48:52 +01:00
hnbgw_rua.c fix regression: in RUA, do PFCP only when enabled 2022-08-29 16:57:28 +02:00
hnbgw_vty.c vty: Fix timers not printed when dumping running-config 2022-11-02 20:12:54 +01:00
mgw_fsm.c fix segfault on MGCP timeout 2023-01-17 23:39:46 +01:00
ps_rab_ass_fsm.c add ps_rab_ass FSM to map GTP via UPF 2022-08-08 20:20:34 +00:00
ps_rab_fsm.c ps_rab_fsm: check use cb success 2022-08-17 14:33:33 +00:00
ranap_rab_ass.c ranap_rab_ass_req_encode(): return msgb 2022-07-27 15:45:18 +02:00
tdefs.c build: add --enable-pfcp, make PFCP dep optional 2022-08-09 17:57:43 +02:00