cellular-infrastructure
/
osmo-msc
mirror of https://gerrit.osmocom.org/osmo-msc
9
0
Fork 0
Code Issues Releases Wiki Activity

libmsc/ran_peer.c: fix msgb memleak in ran_peer_rx_reset() 

It was noticed that SCCP_RAN_MSG_RESET_ACK message is not freed after
sending. Since ran_peer_rx_reset() calls sccp_ran_down_l2_cl(), which
then calls osmo_sccp_user_sap_down_nofree(), which doesn't free the
message buffer (what's clear from its name).

  OsmoMSC# show talloc-context application full filter msgb
  full talloc report on 'osmo_msc' (total  20155 bytes in  88 blocks)
    msgb                  contains   4640 bytes in   5 blocks (ref 0)
      bssmap: reset ack   contains   1160 bytes in   1 blocks (ref 0)
      bssmap: reset ack   contains   1160 bytes in   1 blocks (ref 0)
      bssmap: reset ack   contains   1160 bytes in   1 blocks (ref 0)

Let's free it after sending (or in case of error).

Change-Id: Ic174f6eecd6254af597dfbdc1c9e3d65716f0a76
This commit is contained in:
Vadim Yanitskiy 2019-05-10 02:44:57 +07:00
parent f839967f91
commit 53d3e0e54a
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/libmsc/ran_peer.c
View File

@ -140,11 +140,15 @@ static void ran_peer_rx_reset(struct ran_peer *rp)
if (sccp_ran_down_l2_cl(rp->sri, &rp->peer_addr, reset_ack)) {
LOG_RAN_PEER(rp, LOGL_ERROR, "Failed to send RESET ACKNOWLEDGE message\n");
ran_peer_state_chg(rp, RAN_PEER_ST_WAIT_RX_RESET);
msgb_free(reset_ack);
return;
}
LOG_RAN_PEER(rp, LOGL_INFO, "Sent RESET ACKNOWLEDGE\n");
/* sccp_ran_down_l2_cl() doesn't free msgb */
msgb_free(reset_ack);
ran_peer_state_chg(rp, RAN_PEER_ST_READY);
}