<p>pespin <strong>submitted</strong> this change.</p><p><a href="https://gerrit.osmocom.org/c/osmo-bts/+/25792">View Change</a></p><div style="white-space:pre-wrap">Approvals:
Jenkins Builder: Verified
fixeria: Looks good to me, approved
</div><pre style="font-family: monospace,monospace; white-space: pre-wrap;">lchan: Call lapdm_channel_exit() when state changes to NONE<br><br>Fixes crash when TTCN3 BTS_Tests_LAPDm TC_rr_response_frame_loss<br>runs run after TC_t200_n200.<br><br>The BTS was shutdown after TC_t200_n200 failed (drop oml link), and<br>lchan was moved ACTIVE->NONE without lapdm_channel_exit() being called<br>on it. Hence, on next test (TC_rr_response_frame_loss), when<br>lchan_init_lapdm() was called again, some memory corruption was caused.<br><br>The lapdm_channel_exit can be dropped from gsm_lchan_release() and<br>rsl_tx_rf_rel_ack() since it's already called in the same path:<br>"""<br>rsl_rx_rf_chan_rel<br> gsm_lchan_release(lchan, LCHAN_REL_ACT_RSL);<br> l1sap_chan_rel(lchan->ts->trx, gsm_lchan2chan_nr(lchan));<br> l1sap_chan_act_dact_modify(trx, chan_nr, PRIM_INFO_DEACTIVATE)<br> bts_model_l1sap_down<br> bts_model_lchan_deactivate_sacch(lchan);<br> -<br> lchan_deactivate(lchan);<br> bts_model_lchan_deactivate<br> lchan_set_state(lchan, LCHAN_S_NONE); <---------<br> mph_info_chan_confirm(trx, chan_nr, PRIM_INFO_DEACTIVATE, 0);<br> l1sap_info_rel_cnf<br> rsl_tx_rf_rel_ack(lchan);<br> lapdm_channel_exit(&lchan->lapdm_ch);<br> lapdm_channel_exit(&lchan->lapdm_ch);<br>"""<br><br>Related: SYS#5262<br>Change-Id: If0ec5f0c7be4d15c8d684d33e15e24d68bd5192e<br>---<br>M src/common/lchan.c<br>M src/common/rsl.c<br>2 files changed, 11 insertions(+), 17 deletions(-)<br><br></pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;"><span>diff --git a/src/common/lchan.c b/src/common/lchan.c</span><br><span>index 28ea943..a3be4ee 100644</span><br><span>--- a/src/common/lchan.c</span><br><span>+++ b/src/common/lchan.c</span><br><span>@@ -231,8 +231,6 @@</span><br><span> }</span><br><span> </span><br><span> l1sap_chan_rel(lchan->ts->trx, gsm_lchan2chan_nr(lchan));</span><br><span style="color: hsl(0, 100%, 40%);">-</span><br><span style="color: hsl(0, 100%, 40%);">- lapdm_channel_exit(&lchan->lapdm_ch);</span><br><span> }</span><br><span> </span><br><span> int lchan_deactivate(struct gsm_lchan *lchan)</span><br><span>@@ -290,6 +288,17 @@</span><br><span> osmo_tdef_get(abis_T_defs, -15, OSMO_TDEF_US, -1));</span><br><span> }</span><br><span> break;</span><br><span style="color: hsl(120, 100%, 40%);">+ case LCHAN_S_NONE:</span><br><span style="color: hsl(120, 100%, 40%);">+ lapdm_channel_exit(&lchan->lapdm_ch);</span><br><span style="color: hsl(120, 100%, 40%);">+ /* Also ensure that there are no leftovers from repeated FACCH or</span><br><span style="color: hsl(120, 100%, 40%);">+ * repeated SACCH that might cause memory leakage. */</span><br><span style="color: hsl(120, 100%, 40%);">+ msgb_free(lchan->tch.rep_facch[0].msg);</span><br><span style="color: hsl(120, 100%, 40%);">+ msgb_free(lchan->tch.rep_facch[1].msg);</span><br><span style="color: hsl(120, 100%, 40%);">+ lchan->tch.rep_facch[0].msg = NULL;</span><br><span style="color: hsl(120, 100%, 40%);">+ lchan->tch.rep_facch[1].msg = NULL;</span><br><span style="color: hsl(120, 100%, 40%);">+ msgb_free(lchan->rep_sacch);</span><br><span style="color: hsl(120, 100%, 40%);">+ lchan->rep_sacch = NULL;</span><br><span style="color: hsl(120, 100%, 40%);">+ /* fall through */</span><br><span> default:</span><br><span> if (lchan->early_rr_ia) {</span><br><span> /* Early Immediate Assignment: Transition to any other</span><br><span>diff --git a/src/common/rsl.c b/src/common/rsl.c</span><br><span>index 99e8195..145cc8a 100644</span><br><span>--- a/src/common/rsl.c</span><br><span>+++ b/src/common/rsl.c</span><br><span>@@ -1296,21 +1296,6 @@</span><br><span> gsm_ts_and_pchan_name(lchan->ts), lchan->nr,</span><br><span> gsm_lchant_name(lchan->type));</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- /*</span><br><span style="color: hsl(0, 100%, 40%);">- * Free the LAPDm resources now that the BTS</span><br><span style="color: hsl(0, 100%, 40%);">- * has released all the resources.</span><br><span style="color: hsl(0, 100%, 40%);">- */</span><br><span style="color: hsl(0, 100%, 40%);">- lapdm_channel_exit(&lchan->lapdm_ch);</span><br><span style="color: hsl(0, 100%, 40%);">-</span><br><span style="color: hsl(0, 100%, 40%);">- /* Also ensure that there are no leftovers from repeated FACCH or</span><br><span style="color: hsl(0, 100%, 40%);">- * repeated SACCH that might cause memory leakage. */</span><br><span style="color: hsl(0, 100%, 40%);">- msgb_free(lchan->tch.rep_facch[0].msg);</span><br><span style="color: hsl(0, 100%, 40%);">- msgb_free(lchan->tch.rep_facch[1].msg);</span><br><span style="color: hsl(0, 100%, 40%);">- lchan->tch.rep_facch[0].msg = NULL;</span><br><span style="color: hsl(0, 100%, 40%);">- lchan->tch.rep_facch[1].msg = NULL;</span><br><span style="color: hsl(0, 100%, 40%);">- msgb_free(lchan->rep_sacch);</span><br><span style="color: hsl(0, 100%, 40%);">- lchan->rep_sacch = NULL;</span><br><span style="color: hsl(0, 100%, 40%);">-</span><br><span> return tx_rf_rel_ack(lchan, chan_nr);</span><br><span> }</span><br><span> </span><br><span></span><br></pre><p>To view, visit <a href="https://gerrit.osmocom.org/c/osmo-bts/+/25792">change 25792</a>. To unsubscribe, or for help writing mail filters, visit <a href="https://gerrit.osmocom.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://gerrit.osmocom.org/c/osmo-bts/+/25792"/><meta itemprop="name" content="View Change"/></div></div>
<div style="display:none"> Gerrit-Project: osmo-bts </div>
<div style="display:none"> Gerrit-Branch: master </div>
<div style="display:none"> Gerrit-Change-Id: If0ec5f0c7be4d15c8d684d33e15e24d68bd5192e </div>
<div style="display:none"> Gerrit-Change-Number: 25792 </div>
<div style="display:none"> Gerrit-PatchSet: 2 </div>
<div style="display:none"> Gerrit-Owner: pespin <pespin@sysmocom.de> </div>
<div style="display:none"> Gerrit-Reviewer: Jenkins Builder </div>
<div style="display:none"> Gerrit-Reviewer: fixeria <vyanitskiy@sysmocom.de> </div>
<div style="display:none"> Gerrit-Reviewer: pespin <pespin@sysmocom.de> </div>
<div style="display:none"> Gerrit-MessageType: merged </div>