fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-abis/+/32641 )
Change subject: fix use-after-free in ipaccess_bts_keepalive_fsm_alloc()
......................................................................
fix use-after-free in ipaccess_bts_keepalive_fsm_alloc()
In ipaccess_bts_keepalive_fsm_alloc() we allocate a keepalive FSM
instance as a child of the respective struct ipa_client_conn, and
store the pointer to the respective struct e1inp_ts.
+ struct e1inp_line
|
---+ struct ipaccess_line (void *driver_data)
| |
| ---+ struct ipa_client_conn *ipa_cli[NUM_E1_TS] // <-- parent
|
---+ struct e1inp_ts ts[NUM_E1_TS]
| |
| ---+ .driver.ipaccess.ka_fsm // <-- pointer
When an ipaccess connection (be it OML or RSL) goes down and then
up again, for instance if the BSC gets restarted, osmo-bts crashes.
The problem is that struct ipa_client_conn gets free()ed before the
associated FSM instance gets terminated:
* e1inp_ipa_bts_rsl_connect_n() is called
** calling e1inp_ipa_bts_rsl_close_n()
*** this function free()s struct ipa_client_conn
*** (!) as well as the struct osmo_fsm_inst (talloc child)
** calling ipaccess_bts_keepalive_fsm_alloc()
*** calling ipaccess_keepalive_fsm_cleanup()
**** accessing free()d e1i_ts->driver.ipaccess.ka_fsm
**** BOOOM! segmentation fault
Fix this by calling ipaccess_keepalive_fsm_cleanup() before free()ing
the associated struct ipa_client_conn.
Note that ipaccess_bsc_keepalive_fsm_alloc() is not affected because
it's allocating keepalive FSMs using the global tall_ipa_ctx.
Change-Id: Ic56c4b5b7b24b63104908a0c24f2f645ba4c5c1b
Related: SYS#6438
---
M src/input/ipaccess.c
1 file changed, 49 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-abis refs/changes/41/32641/1
diff --git a/src/input/ipaccess.c b/src/input/ipaccess.c
index 114389e..48a1d40 100644
--- a/src/input/ipaccess.c
+++ b/src/input/ipaccess.c
@@ -192,7 +192,7 @@
struct e1inp_line *line = e1i_ts->line;
struct osmo_fsm_inst *ka_fsm;
- ipaccess_keepalive_fsm_cleanup(e1i_ts);
+ OSMO_ASSERT(e1i_ts->driver.ipaccess.ka_fsm == NULL);
if (!line->ipa_kap)
return;
@@ -1208,6 +1208,7 @@
{
struct ipa_client_conn *conn;
struct ipaccess_line *il;
+ struct e1inp_ts *e1i_ts;
if (E1INP_SIGN_RSL+trx_nr-1 >= NUM_E1_TS) {
LOGP(DLINP, LOGL_ERROR,
@@ -1219,6 +1220,9 @@
if (!il)
return 0; /* Nothing to do, no lines created */
+ e1i_ts = e1inp_line_ipa_rsl_ts(line, trx_nr);
+ ipaccess_keepalive_fsm_cleanup(e1i_ts);
+
conn = il->ipa_cli[1 + trx_nr];
if (conn != NULL) {
ipa_client_conn_close(conn);
--
To view, visit https://gerrit.osmocom.org/c/libosmo-abis/+/32641
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: libosmo-abis
Gerrit-Branch: master
Gerrit-Change-Id: Ic56c4b5b7b24b63104908a0c24f2f645ba4c5c1b
Gerrit-Change-Number: 32641
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-MessageType: newchange
Attention is currently required from: laforge, daniel, lynxis lazus.
pespin has posted comments on this change. ( https://gerrit.osmocom.org/c/libosmocore/+/30936 )
Change subject: gpsr_ns2_udp: Use osmo_io_fd instead of osmo_fd
......................................................................
Patch Set 13: Code-Review+1
(1 comment)
Patchset:
PS13:
The depends in the commit description is not really needed since all is libosmocore.git, but fine having that info.
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/30936
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: Id776d2d9f35c304620f3d5b94492148dd987f5a0
Gerrit-Change-Number: 30936
Gerrit-PatchSet: 13
Gerrit-Owner: daniel <dwillmann(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Attention: daniel <dwillmann(a)sysmocom.de>
Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Comment-Date: Fri, 05 May 2023 14:45:39 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: dexter.
pespin has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/32606 )
Change subject: PCUIF_Types: add record PCUIF_pch_dt
......................................................................
Patch Set 2:
(1 comment)
File library/PCUIF_Types.ttcn:
https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/32606/comment/6d666d22_3cd7…
PS1, Line 320: octetstring data length(162)
> Yes, it it is one mac block long. (see pcuif_proto. […]
But a mac block is 23 bytes -> 184 bits?
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/32606
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: Ia705d3a6fe7adb863acd29e968f8dc6b2066a497
Gerrit-Change-Number: 32606
Gerrit-PatchSet: 2
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-CC: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: dexter <pmaier(a)sysmocom.de>
Gerrit-Comment-Date: Fri, 05 May 2023 14:41:14 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>
Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>
Gerrit-MessageType: comment
Attention is currently required from: Hoernchen, fixeria, daniel.
pespin has posted comments on this change. ( https://gerrit.osmocom.org/c/libasn1c/+/32612 )
Change subject: Disable _ASN_STACK_OVERFLOW_CHECK if building with Asan enabled
......................................................................
Patch Set 3:
(1 comment)
File include/asn1c/asn_internal.h:
https://gerrit.osmocom.org/c/libasn1c/+/32612/comment/c8c09194_52288a67
PS3, Line 137: _ASN_STACK_OVERFLOW_CHECK(asn_codec_ctx_t *ctx) {
> Is this function even useful/used if _ASN_SANITIZE_ENABLED is not defined?
yes, it's precisely when it's useful, since that means there's no tool in place to track this kind of possible issues.
IMHO it should be dropped and ASan be used insted, but I'm letting upstream decide on that :)
--
To view, visit https://gerrit.osmocom.org/c/libasn1c/+/32612
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: libasn1c
Gerrit-Branch: master
Gerrit-Change-Id: I2dda4720f3ea5a023d340863db177e6334beeaa3
Gerrit-Change-Number: 32612
Gerrit-PatchSet: 3
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Hoernchen <ewild(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de>
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de>
Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Attention: daniel <dwillmann(a)sysmocom.de>
Gerrit-Comment-Date: Fri, 05 May 2023 14:38:51 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: daniel <dwillmann(a)sysmocom.de>
Gerrit-MessageType: comment