Osmocom library for A-bis (E1/IP) interface
Go to file
Vadim Yanitskiy c2729a525c fix use-after-free in ipaccess_bts_keepalive_fsm_alloc()
In ipaccess_bts_keepalive_fsm_alloc() we allocate a keepalive FSM
instance as a child of the respective struct ipa_client_conn, and
store the pointer to the respective struct e1inp_ts.

  + struct e1inp_line
  |
  ---+ struct ipaccess_line (void *driver_data)
  |  |
  |  ---+ struct ipa_client_conn *ipa_cli[NUM_E1_TS]  // <-- parent
  |
  ---+ struct e1inp_ts ts[NUM_E1_TS]
  |  |
  |  ---+ .driver.ipaccess.ka_fsm  // <-- pointer

When an ipaccess connection (be it OML or RSL) goes down and then
up again, for instance if the BSC gets restarted, osmo-bts crashes.
The problem is that struct ipa_client_conn gets free()ed before the
associated FSM instance gets terminated:

* e1inp_ipa_bts_rsl_connect_n() is called
** calling e1inp_ipa_bts_rsl_close_n()
*** this function free()s struct ipa_client_conn
*** (!) as well as the struct osmo_fsm_inst (talloc child)
** calling ipaccess_bts_keepalive_fsm_alloc()
*** calling ipaccess_keepalive_fsm_cleanup()
**** accessing free()d e1i_ts->driver.ipaccess.ka_fsm
**** BOOOM!  segmentation fault

Fix this by calling ipaccess_keepalive_fsm_cleanup() before free()ing
the associated struct ipa_client_conn.

Note that ipaccess_bsc_keepalive_fsm_alloc() is not affected because
it's allocating keepalive FSMs using the global tall_ipa_ctx.

Change-Id: Ic56c4b5b7b24b63104908a0c24f2f645ba4c5c1b
Related: SYS#6438
(cherry picked from commit f6bde0f521)
2023-05-08 22:18:14 +07:00
contrib Bump version: 1.2.0.14-dcbc-dirty → 1.3.0 2022-06-28 17:59:38 +02:00
debian Bump version: 1.2.0.14-dcbc-dirty → 1.3.0 2022-06-28 17:59:38 +02:00
include trau_sync: add Ericsson RBS GPRS TRAU synchronization pattern (16kbps) 2022-12-23 11:04:08 +00:00
m4 add missing m4 directory 2011-06-05 18:36:27 +02:00
src fix use-after-free in ipaccess_bts_keepalive_fsm_alloc() 2023-05-08 22:18:14 +07:00
tests Log TRAU FSM at INFO not NOTICE 2021-05-04 15:43:06 -05:00
.gitignore gitignore: Ignore autofoo files *~ 2021-02-23 16:15:21 +01:00
.gitreview Add gerrit settings 2016-12-22 14:06:57 +00:00
AUTHORS add AUTHORS and COPYING files 2011-07-02 17:42:31 +02:00
COPYING add AUTHORS and COPYING files 2011-07-02 17:42:31 +02:00
Makefile.am Makefile.am: EXTRA_DIST: debian, contrib/*.spec.in 2020-05-22 13:27:37 +02:00
README.md update git URLs (git -> https; gitea) 2022-06-17 23:12:04 +02:00
TODO-RELEASE ipaccess: Add connect timeout in e1inp_line 2022-12-15 16:10:36 +01:00
configure.ac configure.ac: Set libosmo-e1d dependency version 2022-06-29 12:15:31 +02:00
git-version-gen git-version-gen: Check first for new tag format 2018-05-02 19:36:36 +02:00
libosmoabis.pc.in pkgconf: require libosmocore 2022-08-10 16:19:12 +07:00
libosmotrau.pc.in pkgconf: require libosmocore 2022-08-10 16:19:12 +07:00

README.md

libosmo-abis - Osmocom Abis interface library

This repository contains a set of C-language libraries that form the A-bis interface library of Osmocom Open Source Mobile Communications projects such as OpenBSC / OsmoBSC.

Historically, a lot of this code was developed as part of the OpenBSC project, but which are of a more generic nature and thus useful to (at least) other programs that we develop in the sphere of Free Software / Open Source mobile communications.

The libosmo-abis.git repository build multiple libraries:

  • libosmoabis contains some abstraction layer over E1/T1 and IP based ETSI/3GPP A-bis interface. It can use mISDN and DAHDI as underlying driver/hardware.
  • libosmotrau contains routines related to A-bis TRAU frame handling

Homepage

The official homepage of the project is https://osmocom.org/projects/libosmo-abis

GIT Repository

You can clone from the official libosmo-abis.git repository using

git clone https://gitea.osmocom.org/osmocom/libosmo-abis

There is a web interface at https://gitea.osmocom.org/osmocom/libosmo-abis

Documentation

There is no Doxygen-generated API documentation yet for this library. It would be great to some day have it, comparable to libosmocore.

Mailing List

Discussions related to libosmo-abis are happening on the openbsc@lists.osmocom.org mailing list, please see https://lists.osmocom.org/mailman/listinfo/openbsc for subscription options and the list archive.

Please observe the Osmocom Mailing List Rules when posting.

Contributing

Our coding standards are described at https://osmocom.org/projects/cellular-infrastructure/wiki/Coding_standards

We us a gerrit based patch submission/review process for managing contributions. Please see https://osmocom.org/projects/cellular-infrastructure/wiki/Gerrit for more details

The current patch queue for libosmo-abis can be seen at https://gerrit.osmocom.org/#/q/project:libosmo-abis+status:open