forked from cellular-infrastructure/osmo-pcu
fix PACCH paging: don't return early in case of NULL TBF
Commitb78a4a6dfe
tried to fix a NULL dereference error, but apparently was overly eager to return, because it looked like all code paths would dereference the tbf. In fact the code path further above, for msg != NULL, has "always" dereferenced the tbf, but the lower code path, the one effecting the paging, has only started to dereference tbf since shortly before the overly eager fix: inda7250ad2c
, to "update the dl ctrl msg counter for ms". It seems that this tbf dereference in the paging path is bogus and the cause for the segfault that made me write the early exit fix. Fix that fix: Do not exit early if tbf == NULL, stay in there to be able to reach the paging path below. In case of a message to be sent, assume that tbf is present, and verify: print an error message and abort if there is a msg but no tbf, so that we will see the error if I'm wrong there. If a tbf is missing, free the msg. In case of no message, go on to send pending pagings, but do not attempt to count ctrl messages for a tbf -- IIUC there will never be a tbf if we're paging. This should avoid segfaults while keeping PACCH paging intact. Tweak a comment for and add a blank line above the paging section. Related: OS#2176 CID#158969 Change-Id: Ib79f4a945e211a13ac7d1e511cc37b0940ac6202
This commit is contained in:
parent
333d7e6345
commit
3de6d0602f
|
@ -178,11 +178,14 @@ static struct msgb *sched_select_ctrl_msg(
|
|||
}
|
||||
}
|
||||
|
||||
if (!tbf)
|
||||
return NULL;
|
||||
|
||||
/* any message */
|
||||
if (msg) {
|
||||
if (!tbf) {
|
||||
LOGP(DRLCMACSCHED, LOGL_ERROR,
|
||||
"Control message to be scheduled, but no TBF (TRX=%d, TS=%d)\n", trx, ts);
|
||||
msgb_free(msg);
|
||||
return NULL;
|
||||
}
|
||||
tbf->rotate_in_list();
|
||||
LOGP(DRLCMACSCHED, LOGL_DEBUG, "Scheduling control "
|
||||
"message at RTS for %s (TRX=%d, TS=%d)\n",
|
||||
|
@ -191,14 +194,12 @@ static struct msgb *sched_select_ctrl_msg(
|
|||
tbf->ms()->update_dl_ctrl_msg();
|
||||
return msg;
|
||||
}
|
||||
/* schedule PACKET PAGING REQUEST */
|
||||
|
||||
/* schedule PACKET PAGING REQUEST, if any are pending */
|
||||
msg = pdch->packet_paging_request();
|
||||
if (msg) {
|
||||
LOGP(DRLCMACSCHED, LOGL_DEBUG, "Scheduling paging request "
|
||||
"message at RTS for (TRX=%d, TS=%d)\n", trx, ts);
|
||||
|
||||
/* Updates the dl ctrl msg counter for ms */
|
||||
tbf->ms()->update_dl_ctrl_msg();
|
||||
return msg;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue