fix sms layer timer leak/corruiption using trans_free()

we only stopped the cp1* timer on reception of cp-ack, but not
in error cases like rx of cp-error.
This commit is contained in:
Harald Welte (local) 2009-08-14 14:52:17 +02:00
parent fed176ab90
commit 86b17172fd
2 changed files with 10 additions and 2 deletions

View File

@ -686,7 +686,7 @@ static int gsm411_rx_rp_error(struct msgb *msg, struct gsm_trans *trans,
sms_free(sms);
trans->sms.sms = NULL;
trans_free(trans);
//trans_free(trans);
return 0;
}
@ -763,7 +763,7 @@ static int gsm411_tx_cp_ack(struct gsm_trans *trans)
if (trans->sms.is_mt) {
/* If this is a MT SMS DELIVER, we can clear transaction here */
trans->sms.cp_state = GSM411_CPS_IDLE;
trans_free(trans);
//trans_free(trans);
}
return rc;
@ -1069,6 +1069,11 @@ static int subscr_sig_cb(unsigned int subsys, unsigned int signal,
return 0;
}
void _gsm411_sms_trans_free(struct gsm_trans *trans)
{
bsc_del_timer(&trans->sms.cp_timer);
}
static __attribute__((constructor)) void on_dso_load_sms(void)
{
tall_gsms_ctx = talloc_named_const(tall_bsc_ctx, 1, "sms");

View File

@ -92,6 +92,9 @@ void trans_free(struct gsm_trans *trans)
case GSM48_PDISC_CC:
_gsm48_cc_trans_free(trans);
break;
case GSM48_PDISC_SMS:
_gsm411_sms_trans_free(trans);
break;
}
if (trans->lchan)