bts: delete pch_timer list in destructor

Run bts_pch_timer_remove() on each entry of the BTS specific pch_timer
list, so we don't have a memory leak and so the timer doesn't
potentially fire for a deallocated BTS.

Fixes: d3c7591 ("Add counters: pcu.bts.N.pch.requests.timeout")
Change-Id: Ia5e33d1894408e93a51c452002ef2f5758808269

src/bts.cpp

@@ -32,6 +32,7 @@
 #include <pdch.h>
 #include <gprs_ms_storage.h>
 #include <sba.h>
+#include <bts_pch_timer.h>
 
 extern "C" {
 	#include <osmocom/core/talloc.h>
@@ -230,6 +231,8 @@ static int bts_talloc_destructor(struct gprs_rlcmac_bts* bts)
 		bts->app_info = NULL;
 	}
 
+	bts_pch_timer_stop_all(bts);
+
 	llist_del(&bts->list);
 	return 0;
 }

src/bts_pch_timer.c

@@ -83,3 +83,12 @@ void bts_pch_timer_stop(struct gprs_rlcmac_bts *bts, const char *imsi)
 	if (p)
 		bts_pch_timer_remove(p);
 }
+
+void bts_pch_timer_stop_all(struct gprs_rlcmac_bts *bts)
+{
+	struct bts_pch_timer *p, *n;
+
+	llist_for_each_entry_safe(p, n, &bts->pch_timer, entry) {
+		bts_pch_timer_remove(p);
+	}
+}

src/bts_pch_timer.h

@@ -37,6 +37,7 @@ struct bts_pch_timer {
 
 void bts_pch_timer_start(struct gprs_rlcmac_bts *bts, const char *imsi);
 void bts_pch_timer_stop(struct gprs_rlcmac_bts *bts, const char *imsi);
+void bts_pch_timer_stop_all(struct gprs_rlcmac_bts *bts);
 
 #ifdef __cplusplus
 }

tests/alloc/AllocTest.cpp

@@ -24,6 +24,7 @@
 #include "tbf_dl.h"
 #include "bts.h"
 #include "gprs_ms.h"
+#include "bts_pch_timer.h"
 
 #include <string.h>
 #include <stdio.h>
@@ -802,6 +803,23 @@ static void test_2_consecutive_dl_tbfs()
 	talloc_free(bts);
 }
 
+static void test_bts_pch_timer(void)
+{
+	struct gprs_rlcmac_bts *bts = bts_alloc(the_pcu, 0);
+	const char *imsi1 = "1234";
+	const char *imsi2 = "5678";
+
+	fprintf(stderr, "Testing bts_pch_timer dealloc on bts dealloc\n");
+	log_set_category_filter(osmo_stderr_target, DPCU, 1, LOGL_DEBUG);
+
+	fprintf(stderr, "Starting PCH timer for 2 IMSI\n");
+	bts_pch_timer_start(bts, imsi1);
+	bts_pch_timer_start(bts, imsi2);
+
+	fprintf(stderr, "Deallocating BTS, expecting the PCH timer to be stopped and deallocated\n");
+	talloc_free(bts);
+}
+
 int main(int argc, char **argv)
 {
 	tall_pcu_ctx = talloc_named_const(NULL, 1, "moiji-mobile AllocTest context");
@@ -828,6 +846,7 @@ int main(int argc, char **argv)
 	test_many_connections(alloc_algorithm_b, 32, "B");
 	test_many_connections(alloc_algorithm_dynamic, 160, "dynamic");
 	test_2_consecutive_dl_tbfs();
+	test_bts_pch_timer();
 
 	talloc_free(the_pcu);
 	return EXIT_SUCCESS;

tests/alloc/AllocTest.err

@@ -326119,3 +326119,10 @@ TBF(DL-TFI_0){RELEASING}: Deallocated
 TBF(DL-TFI_1){NULL}: state_chg to RELEASING
 TBF(TFI=1 TLLI=0xffffffff DIR=DL STATE=RELEASING EGPRS) free
 TBF(DL-TFI_1){RELEASING}: Deallocated
+Testing bts_pch_timer dealloc on bts dealloc
+Starting PCH timer for 2 IMSI
+PCH paging timer started for IMSI=1234
+PCH paging timer started for IMSI=5678
+Deallocating BTS, expecting the PCH timer to be stopped and deallocated
+PCH paging timer stopped for IMSI=1234
+PCH paging timer stopped for IMSI=5678