Commit Graph

4 Commits

Author SHA1 Message Date
Neels Hofmeyr cd325efae5 gprs_bssgp: bssgp_fc_in(): fix mem leak on queue overflow
All successful and all error code paths of bssgp_fc_in() free the msgb, except
the code path calling fc_enqueue() when the msg is dropped (due to queue being
full, or failure to allocate).

Callers could theoretically catch the -ENOSPC return value and discard the
msgb. However, in other code paths, a callback's return value is returned,
which is expected to free the msgb, so such callback would have to never return
-ENOSPC when it freed the msgb. Much simpler semantics would be to free the
msgb in every code path, no matter which kind of error occurred.

Who is currently calling bssgp_fc_in and how do they handle the return value?
- bssgp_fc_test.c ignores the return value (and hits a mem leak aka sanitizer
  build failure if the queue is full).
- fc_timer_cb() ignores the return value.
- bssgp_tx_dl_ud() returns the bssgp_fc_in() rc.
  - which is returned by a cascade of functions leading up to being returned,
    for example, by gprs_llgmm_reset(), which is usually called with ignored
    return code.
At this point it is already fairly clear that bssgp_fc_in() should always free
the msgb, since the callers don't seem to distinguish even between error or
success, let alone between -ENOSPC or other errors.

bssgp_fc_test: assert that no msgbs remain unfreed after the tests.
Adjust expected results.

Helps fix sanitizer build on debian 9.

Change-Id: I00c62a104baeaad6a85883c380259c469aebf0df
2017-11-20 17:22:42 +01:00
Neels Hofmeyr 0128c78ffe bssgp_fc_test: sanitizer: free msgb context when done
Print remaining msgbs when done, then free the entire tall_msgb_context. To be
able to do that, call msgb_talloc_ctx_init() and use its return value.

A subsequent patch will fix a known mem leak and add assertions for 0b in 1
blocks remaining in the tall_msgb_context.

Helps fix sanitizer build on debian 9.

Change-Id: I67d347ab2642b0bfc27b21b44231a7f3146ff641
2017-11-20 17:22:42 +01:00
Neels Hofmeyr 9541a68378 bssgp_fc_test: clarify by outputting ok / failure messages
The test fills up the queue / sends too large PDUs on purpose. Make that
obvious by outputting returned errors in the expected output.

Cosmetic:
- fc_in()'s return value is ignored, hence don't return anything.
- add comment.

Change-Id: I57d6fce2515a65f6dd037e75af5397079215cb46
2017-11-20 17:22:42 +01:00
Harald Welte 04f0989d11 GPRS BSSGP test: integrate into autotest
we use a smalle shell script to iterate over multiple tests
2012-09-07 12:07:54 +02:00