cellular-infrastructure
/
osmo-sgsn
mirror of https://gerrit.osmocom.org/osmo-sgsn
9
0
Fork 0
Code Issues Releases Wiki Activity

Fix crash rx DeactPdpReq while waiting for DeactPdpAck after gtp side is freed 

Scenario:
1- For an unknwon reason, sgsn sends DeletePdpCtxReq on GTP towards GGSN.
2- GGSN answers with Error Indication to that pdp ctx which calls
   gtp_freepdp()
3- gtp_freepdp() calls libgtp callback cb_delete_context() before freeing the
   pointer, in osmo-sgsn callback points to cb_delete_context(), which
   removes pctx->ggsn and tries to drop the pdp on the NS side by sending a
   DeactPdpReq.
4- While waiting for DeactPdpAck, the MS/PCU sends a DeactPdpReq, and
   code was unconditionalyl trying to release the gtp side without checking
   if it was alreay released, using pctx->ggsn==NULL and crashing.

This is basically the same logic already in place in regular path
gsm48_rx_gsm_deact_pdp_ack.

Related: OS#4817
Change-Id: I02587a3dc812823d893fc00b904142b75fd190b9
This commit is contained in:
Pau Espin 2020-10-19 16:38:25 +02:00 committed by laforge
parent ff5b59a821
commit 5ce54ba1e6
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/sgsn/gprs_sm.c
View File

@ -639,7 +639,11 @@ static int gsm48_rx_gsm_deact_pdp_req(struct sgsn_mm_ctx *mm, struct msgb *msg)
return _gsm48_tx_gsm_deact_pdp_acc(mm, transaction_id);
}
return sgsn_delete_pdp_ctx(pdp);
if (pdp->ggsn)
return sgsn_delete_pdp_ctx(pdp);
/* GTP side already detached, freeing */
sgsn_pdp_ctx_free(pdp);
return 0;
}
/* 3GPP TS 24.008 § 9.5.9: Deactivate PDP Context Accept */