Osmocom Serving GPRS Support Node for 2G(GPRS) and 3G(UMTS)
https://osmocom.org/projects/osmosgsn
Scenario: 1- For an unknwon reason, sgsn sends DeletePdpCtxReq on GTP towards GGSN. 2- GGSN answers with Error Indication to that pdp ctx which calls gtp_freepdp() 3- gtp_freepdp() calls libgtp callback cb_delete_context() before freeing the pointer, in osmo-sgsn callback points to cb_delete_context(), which removes pctx->ggsn and tries to drop the pdp on the NS side by sending a DeactPdpReq. 4- While waiting for DeactPdpAck, the MS/PCU sends a DeactPdpReq, and code was unconditionalyl trying to release the gtp side without checking if it was alreay released, using pctx->ggsn==NULL and crashing. This is basically the same logic already in place in regular path gsm48_rx_gsm_deact_pdp_ack. Related: OS#4817 Change-Id: I02587a3dc812823d893fc00b904142b75fd190b9 |
||
---|---|---|
contrib | ||
debian | ||
doc | ||
include | ||
m4 | ||
src | ||
tests | ||
.gitignore | ||
.gitreview | ||
.mailmap | ||
AUTHORS | ||
COPYING | ||
Makefile.am | ||
README | ||
README.vty-tests | ||
TODO-RELEASE | ||
configure.ac | ||
git-version-gen | ||
osmoappdesc.py |
README
About OsmoSGSN ============== OsmoSGSN originated from the OpenBSC project, as a separate program within openbsc.git. In 2017, OpenBSC was split in separate repositories, and hence OsmoSGSN was given its own separate git repository. OsmoSGSN exposes - GSUP towards OsmoHLR (or a MAP proxy); - GTP towards a GGSN (e.g. OsmoGGSN); - Gb towards a BSS (e.g. OsmoPCU); - IuPS towards an RNC or HNB-GW (e.g. OsmoHNBGW) for 3G data; - The Osmocom typical telnet VTY and CTRL interfaces. Find OsmoSGSN issue tracker and wiki online at https://osmocom.org/projects/osmosgsn https://osmocom.org/projects/osmosgsn/wiki