Fix crash rx DeactPdpReq while waiting for DeactPdpAck after gtp side is freed
Scenario: 1- For an unknwon reason, sgsn sends DeletePdpCtxReq on GTP towards GGSN. 2- GGSN answers with Error Indication to that pdp ctx which calls gtp_freepdp() 3- gtp_freepdp() calls libgtp callback cb_delete_context() before freeing the pointer, in osmo-sgsn callback points to cb_delete_context(), which removes pctx->ggsn and tries to drop the pdp on the NS side by sending a DeactPdpReq. 4- While waiting for DeactPdpAck, the MS/PCU sends a DeactPdpReq, and code was unconditionalyl trying to release the gtp side without checking if it was alreay released, using pctx->ggsn==NULL and crashing. This is basically the same logic already in place in regular path gsm48_rx_gsm_deact_pdp_ack. Related: OS#4817 Change-Id: I02587a3dc812823d893fc00b904142b75fd190b9
This commit is contained in:
parent
ff5b59a821
commit
5ce54ba1e6
|
@ -639,7 +639,11 @@ static int gsm48_rx_gsm_deact_pdp_req(struct sgsn_mm_ctx *mm, struct msgb *msg)
|
||||||
return _gsm48_tx_gsm_deact_pdp_acc(mm, transaction_id);
|
return _gsm48_tx_gsm_deact_pdp_acc(mm, transaction_id);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (pdp->ggsn)
|
||||||
return sgsn_delete_pdp_ctx(pdp);
|
return sgsn_delete_pdp_ctx(pdp);
|
||||||
|
/* GTP side already detached, freeing */
|
||||||
|
sgsn_pdp_ctx_free(pdp);
|
||||||
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* 3GPP TS 24.008 § 9.5.9: Deactivate PDP Context Accept */
|
/* 3GPP TS 24.008 § 9.5.9: Deactivate PDP Context Accept */
|
||||||
|
|
Loading…
Reference in New Issue