This is merely a historical archive of years 2008-2021, before the migration to mailman3.
A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.
lynxis lazus gerrit-no-reply at lists.osmocom.orglynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/22966 ) Change subject: gprs_ns2: free_nse: free the SNS fsm early ...................................................................... gprs_ns2: free_nse: free the SNS fsm early If the SNS fsm isn't freed early, the SNS code will re-create a NSVC when calling free_nsvc(). Fixes libasan heap-use-after-free. Change-Id: If350df1d8d6dcea5715dd23b8bd1d684098cdb1f --- M src/gb/gprs_ns2.c 1 file changed, 5 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/66/22966/1 diff --git a/src/gb/gprs_ns2.c b/src/gb/gprs_ns2.c index c48575b..a79dd05 100644 --- a/src/gb/gprs_ns2.c +++ b/src/gb/gprs_ns2.c @@ -831,12 +831,15 @@ return; nse->alive = false; + if (nse->bss_sns_fi) { + osmo_fsm_inst_term(nse->bss_sns_fi, OSMO_FSM_TERM_REQUEST, NULL); + nse->bss_sns_fi = NULL; + } + gprs_ns2_free_nsvcs(nse); ns2_prim_status_ind(nse, NULL, 0, GPRS_NS2_AFF_CAUSE_FAILURE); llist_del(&nse->list); - if (nse->bss_sns_fi) - osmo_fsm_inst_term(nse->bss_sns_fi, OSMO_FSM_TERM_REQUEST, NULL); talloc_free(nse); } -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/22966 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: If350df1d8d6dcea5715dd23b8bd1d684098cdb1f Gerrit-Change-Number: 22966 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis at fe80.eu> Gerrit-MessageType: newchange -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20210219/98478998/attachment.htm>