Attention is currently required from: lynxis lazus.
daniel has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/37860?usp=email )
Change subject: Replace gprs_ra_id with modern osmo_routing_area_id
......................................................................
Patch Set 3: Code-Review+1
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/37860?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: Ia41eb8f51d3836b1bc65325ff1ec6bdb16e20c7e
Gerrit-Change-Number: 37860
Gerrit-PatchSet: 3
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Comment-Date: Mon, 19 Aug 2024 16:33:02 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Attention is currently required from: daniel, lynxis lazus.
pespin has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/37860?usp=email )
Change subject: Replace gprs_ra_id with modern osmo_routing_area_id
......................................................................
Patch Set 3: Code-Review+1
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/37860?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: Ia41eb8f51d3836b1bc65325ff1ec6bdb16e20c7e
Gerrit-Change-Number: 37860
Gerrit-PatchSet: 3
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: daniel <dwillmann(a)sysmocom.de>
Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Comment-Date: Mon, 19 Aug 2024 16:30:27 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/37870?usp=email )
Change subject: Fix double free during RAU with unexpected Old RAI
......................................................................
Fix double free during RAU with unexpected Old RAI
If an MS which had an MMCTX at the SGSN sent RAU update with an
unexpected Old RA field, the RAU was rejected and LLME (LLC layer)
unassigned (freed), because no MMCTX was found matching the wrong old
RA.
However, an MMCTX may actually exist pointing to that LLME, and hence
when the LLME is freed, it stayed unnoticed with a dangling pointer to
the freed LLME in ctx->gb.llme.
Let's try to harder to avoid this kind of bugs which make osmo-sgsn
crash.
Once we properly split the code into separate independent layers (LLC,
MMCTX, etc.) each holding their own structs, this kind of bugs shouldn't
happen anymore.
Related: OS#6441
Change-Id: I5a4328c6e945b85dd815215724feecadba59c435
---
M include/osmocom/sgsn/mmctx.h
M src/sgsn/gprs_gmm.c
M src/sgsn/mmctx.c
3 files changed, 31 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/70/37870/1
diff --git a/include/osmocom/sgsn/mmctx.h b/include/osmocom/sgsn/mmctx.h
index c19f599..5e4662f 100644
--- a/include/osmocom/sgsn/mmctx.h
+++ b/include/osmocom/sgsn/mmctx.h
@@ -257,6 +257,7 @@
struct sgsn_mm_ctx *sgsn_mm_ctx_by_ptmsi(uint32_t tmsi);
struct sgsn_mm_ctx *sgsn_mm_ctx_by_imsi(const char *imsi);
struct sgsn_mm_ctx *sgsn_mm_ctx_by_ue_ctx(const void *uectx);
+struct sgsn_mm_ctx *sgsn_mm_ctx_by_llme(const struct gprs_llc_llme *llme);
/* look-up by matching TLLI and P-TMSI (think twice before using this) */
struct sgsn_mm_ctx *sgsn_mm_ctx_by_tlli_and_ptmsi(uint32_t tlli,
diff --git a/src/sgsn/gprs_gmm.c b/src/sgsn/gprs_gmm.c
index ab8b7ef..911d42d 100644
--- a/src/sgsn/gprs_gmm.c
+++ b/src/sgsn/gprs_gmm.c
@@ -1748,6 +1748,21 @@
* in the MS */
LOGGBP(llme, DMM, LOGL_NOTICE, "LLC XID RESET\n");
gprs_llgmm_reset_oldmsg(msg, GPRS_SAPI_GMM, llme);
+
+ /* The RAU didn't come from expected TLLI+RAI, so it's for sure bad and should be rejected.
+ * In any case, before unassigning (freeing) the LLME during the REJECT below, make sure
+ * beforehand that if there's an mmctx relating to that llme it is also freed.
+ * Otherwise it would be kept pointining at a dangling freed llme object.
+ */
+ mmctx = sgsn_mm_ctx_by_llme(llme);
+ if (mmctx) {
+ char old_ra_id_name[32];
+ osmo_rai_name_buf(old_ra_id_name, sizeof(old_ra_id_name), &old_ra_id);
+ LOGMMCTXP(LOGL_NOTICE, mmctx,
+ "Rx RA Update Request with unexpected TLLI=%08x Old RA=%s (expected Old RA: %s)!\n",
+ msgb_tlli(msg), old_ra_id_name, osmo_rai_name(&mmctx->ra));
+ /* mmctx will be released (and its llme un assigned) after REJECT below. */
+ }
}
/* The MS has to perform GPRS attach */
/* Device is still IMSI attached for CS but initiate GPRS ATTACH,
diff --git a/src/sgsn/mmctx.c b/src/sgsn/mmctx.c
index 0e93092..459f6cf 100644
--- a/src/sgsn/mmctx.c
+++ b/src/sgsn/mmctx.c
@@ -105,6 +105,21 @@
return NULL;
}
+
+/* look-up an SGSN MM context based on Gb LLME context (struct gprs_llc_llme)*/
+struct sgsn_mm_ctx *sgsn_mm_ctx_by_llme(const struct gprs_llc_llme *llme)
+{
+ struct sgsn_mm_ctx *ctx;
+
+ llist_for_each_entry (ctx, &sgsn->mm_list, list) {
+ if (ctx->ran_type == MM_CTX_T_GERAN_Gb
+ && llme == ctx->gb.llme)
+ return ctx;
+ }
+
+ return NULL;
+}
+
/* look-up a SGSN MM context based on TLLI + RAI */
struct sgsn_mm_ctx *sgsn_mm_ctx_by_tlli(uint32_t tlli,
const struct gprs_ra_id *raid)
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/37870?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: I5a4328c6e945b85dd815215724feecadba59c435
Gerrit-Change-Number: 37870
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/37871?usp=email )
Change subject: llc: Mark old/current tlli as all 1's when unassigning LLME
......................................................................
llc: Mark old/current tlli as all 1's when unassigning LLME
TS 44.064 section 8.3.3 (and other sections) talk about special
unassigned value of "all 1's", but I couldn't find any reference to a
"all 0's" specific value/meaning.
In practice in the code this may not be super important since those
values may not ve checked due to the FSM state, but in any case they are
initially set to all 1's, so it makes total sense to re-set them to the
same unassigned value instead of a randomly chosen all 0's value.
Change-Id: I660c8d0ef08b34f8cb74fd51b5c59e5628d687ae
---
M src/sgsn/gprs_llc.c
1 file changed, 1 insertion(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/71/37871/1
diff --git a/src/sgsn/gprs_llc.c b/src/sgsn/gprs_llc.c
index 6f56385..82e876d 100644
--- a/src/sgsn/gprs_llc.c
+++ b/src/sgsn/gprs_llc.c
@@ -1112,7 +1112,7 @@
llme->state = GPRS_LLMS_ASSIGNED;
} else if (old_tlli != TLLI_UNASSIGNED && new_tlli == TLLI_UNASSIGNED) {
/* TLLI Unassignment 8.3.3) */
- llme->tlli = llme->old_tlli = 0;
+ llme->tlli = llme->old_tlli = TLLI_UNASSIGNED;
llme->state = GPRS_LLMS_UNASSIGNED;
for (i = 0; i < ARRAY_SIZE(llme->lle); i++) {
struct gprs_llc_lle *l = &llme->lle[i];
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/37871?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: I660c8d0ef08b34f8cb74fd51b5c59e5628d687ae
Gerrit-Change-Number: 37871
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Attention is currently required from: lynxis lazus.
daniel has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/libosmocore/+/37831?usp=email )
Change subject: add convert functions for old gprs_ra_id and the new osmo_routing_area_id
......................................................................
Patch Set 2: Code-Review+1
Copied votes on follow-up patch sets have been updated:
* Code-Review+1 has been copied to patch set 3 (copy condition: "changekind:NO_CHANGE OR changekind:TRIVIAL_REBASE OR is:MIN").
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/37831?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: Iaef54cac541913534af00f40483723e9952a6807
Gerrit-Change-Number: 37831
Gerrit-PatchSet: 2
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Comment-Date: Mon, 19 Aug 2024 16:18:15 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Attention is currently required from: daniel, pespin.
Hello Jenkins Builder, daniel, pespin,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/libosmocore/+/37794?usp=email
to look at the new patch set (#6).
The following approvals got outdated and were removed:
Code-Review+1 by pespin, Verified+1 by Jenkins Builder
Change subject: gb: add bssgp_parse_cell_id2/bssgp_create_cell_id2
......................................................................
gb: add bssgp_parse_cell_id2/bssgp_create_cell_id2
Add bssgp_cell_id functions which use the new struct osmo_routing_area_id.
Related: OS#6536
Change-Id: I6cdae75a32547968add2421a07d287a0a42bdbc0
---
M TODO-RELEASE
M include/osmocom/gprs/gprs_bssgp.h
M src/gb/gprs_bssgp.c
M src/gb/libosmogb.map
4 files changed, 44 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/94/37794/6
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/37794?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: I6cdae75a32547968add2421a07d287a0a42bdbc0
Gerrit-Change-Number: 37794
Gerrit-PatchSet: 6
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: daniel <dwillmann(a)sysmocom.de>