Change in osmo-bsc[master]: Fix crash in bsc_patch_mm_info()

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.

laforge gerrit-no-reply at lists.osmocom.org
Tue May 19 20:33:42 UTC 2020


laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-bsc/+/18338 )

Change subject: Fix crash in bsc_patch_mm_info()
......................................................................

Fix crash in bsc_patch_mm_info()

osmo-bsc has crashed with the following backtrace:

0  __GI_raise (sig=sig at entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
1  0x00007f0bc49b38db in __GI_abort () at abort.c:100
2  0x00007f0bc581ba30 in osmo_panic () from /usr/lib/x86_64-linux-gnu/libosmocore.so.12
3  0x00005648ceeced69 in conn_get_bts (conn=<optimized out>) at ../../include/osmocom/bsc/gsm_data.h:1392
4  0x00005648cef37164 in conn_get_bts (conn=0x5648cf769e80) at osmo_bsc_filter.c:87
5  bsc_patch_mm_info (conn=conn at entry=0x5648cf769e80, data=<optimized out>, length=<optimized out>) at osmo_bsc_filter.c:48
6  0x00005648cef371b6 in bsc_scan_msc_msg (conn=conn at entry=0x5648cf769e80, msg=msg at entry=0x5648cf77ead0) at osmo_bsc_filter.c:159
7  0x00005648cef33988 in dtap_rcvmsg (msg=0x5648cf72b2f0, length=40, conn=0x5648cf769e80) at osmo_bsc_bssap.c:1215
8  bsc_handle_dt (conn=conn at entry=0x5648cf769e80, msg=0x5648cf72b2f0, len=40) at osmo_bsc_bssap.c:1299
9  0x00005648cef3b2b7 in handle_data_from_msc (msg=<optimized out>, conn=0x5648cf769e80) at osmo_bsc_sigtran.c:152
10 sccp_sap_up (oph=0x5648cf72b378, _scu=<optimized out>) at osmo_bsc_sigtran.c:267
11 0x00007f0bc5813c03 in _osmo_fsm_inst_dispatch () from /usr/lib/x86_64-linux-gnu/libosmocore.so.12
12 0x00007f0bc51a8935 in sccp_scoc_rx_from_scrc (inst=inst at entry=0x5648cf6a8d60, xua=xua at entry=0x5648cf720150) at sccp_scoc.c:1695
13 0x00007f0bc51a62f3 in scrc_rx_mtp_xfer_ind_xua (inst=inst at entry=0x5648cf6a8d60, xua=xua at entry=0x5648cf720150) at sccp_scrc.c:459
14 0x00007f0bc51a9545 in mtp_user_prim_cb (oph=0x5648cf7681f8, ctx=0x5648cf6a8d60) at sccp_user.c:182
15 0x00007f0bc51a09c6 in m3ua_rx_xfer (xua=0x5648cf764a80, asp=0x5648cf45f540) at m3ua.c:586
16 m3ua_rx_msg (asp=asp at entry=0x5648cf45f540, msg=msg at entry=0x5648cf71e880) at m3ua.c:739
17 0x00007f0bc51b0763 in xua_cli_read_cb (conn=0x5648cf441ed0) at osmo_ss7.c:1761
18 0x00007f0bc55fab53 in osmo_stream_cli_read (cli=0x5648cf441ed0) at stream.c:232
19 osmo_stream_cli_fd_cb (ofd=<optimized out>, what=1) at stream.c:321
20 0x00007f0bc580edcf in ?? () from /usr/lib/x86_64-linux-gnu/libosmocore.so.12
21 0x00007f0bc580f526 in osmo_select_main_ctx () from /usr/lib/x86_64-linux-gnu/libosmocore.so.12
22 0x00005648ceecfb2f in main (argc=<optimized out>, argv=<optimized out>) at osmo_bsc_main.c:953

Apparently, there is no lchan allocated at this moment, so
conn_get_bts() crashes. But we only use it to get to "network" which
we can do much easier and safer by doing conn->network.

Change-Id: Id3f7b3efba60c0f050c1be98e5e539f1dab4cd57
---
M src/osmo-bsc/osmo_bsc_filter.c
M tests/bsc/bsc_test.c
2 files changed, 3 insertions(+), 11 deletions(-)

Approvals:
  laforge: Looks good to me, approved
  pespin: Looks good to me, but someone else must approve
  Jenkins Builder: Verified



diff --git a/src/osmo-bsc/osmo_bsc_filter.c b/src/osmo-bsc/osmo_bsc_filter.c
index 332ba6b..3b72aee 100644
--- a/src/osmo-bsc/osmo_bsc_filter.c
+++ b/src/osmo-bsc/osmo_bsc_filter.c
@@ -45,7 +45,6 @@
 {
 	struct tlv_parsed tp;
 	int parse_res;
-	struct gsm_bts *bts = conn_get_bts(conn);
 	int tzunits;
 	uint8_t tzbsd = 0;
 	uint8_t dst = 0;
@@ -58,7 +57,7 @@
 		return 0;
 
 	/* Is TZ patching enabled? */
-	struct gsm_tz *tz = &bts->network->tz;
+	struct gsm_tz *tz = &conn->network->tz;
 	if (!tz->override)
 		return 0;
 
diff --git a/tests/bsc/bsc_test.c b/tests/bsc/bsc_test.c
index 6079ec5..5d87118 100644
--- a/tests/bsc/bsc_test.c
+++ b/tests/bsc/bsc_test.c
@@ -123,16 +123,9 @@
 	int i;
 
 	struct gsm_network *net = gsm_network_init(ctx);
-	struct gsm_bts *bts = gsm_bts_alloc(net, 0);
-	struct bsc_msc_data *msc;
-	struct gsm_subscriber_connection *conn;
+	struct gsm_subscriber_connection *conn = talloc_zero(net, struct gsm_subscriber_connection);
 
-	msc = talloc_zero(net, struct bsc_msc_data);
-	conn = talloc_zero(net, struct gsm_subscriber_connection);
-
-	bts->network = net;
-	conn->sccp.msc = msc;
-	conn->lchan = &bts->c0->ts[1].lchan[0];
+	conn->network = net;
 
 	/* start testing with proper messages */
 	printf("Testing BTS<->MSC message scan.\n");

-- 
To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/18338
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-bsc
Gerrit-Branch: master
Gerrit-Change-Id: Id3f7b3efba60c0f050c1be98e5e539f1dab4cd57
Gerrit-Change-Number: 18338
Gerrit-PatchSet: 4
Gerrit-Owner: ipse <Alexander.Chemeris at gmail.com>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge at osmocom.org>
Gerrit-Reviewer: pespin <pespin at sysmocom.de>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20200519/c53d7d76/attachment.htm>


More information about the gerrit-log mailing list