pespin has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/39808?usp=email )
Change subject: lapdm: Take talloc msgb ownership when enqueueing it
......................................................................
lapdm: Take talloc msgb ownership when enqueueing it
Otherwise the msg talloc reference is kept parented at some unknown
pointer in some unknown upper layer, which may cause memory corruption
or use-after-free.
Change-Id: Iba7b11bd9541c883588f34df67fdd865d72710d7
Related: OS#6728
---
M src/gsm/lapdm.c
1 file changed, 4 insertions(+), 0 deletions(-)
Approvals:
Jenkins Builder: Verified
pespin: Looks good to me, approved
diff --git a/src/gsm/lapdm.c b/src/gsm/lapdm.c
index 61ea535..f725b44 100644
--- a/src/gsm/lapdm.c
+++ b/src/gsm/lapdm.c
@@ -376,6 +376,8 @@
*msgb_push(msg, 1) = pad;
*msgb_push(msg, 1) = link_id;
*msgb_push(msg, 1) = chan_nr;
+ /* Take ownership of msg, since we are keeping it around in this layer: */
+ talloc_steal(tall_lapd_ctx, msg);
msgb_enqueue(&dl->dl.tx_queue, msg);
return 0;
}
@@ -403,6 +405,8 @@
*msgb_push(msg, 1) = pad;
*msgb_push(msg, 1) = link_id;
*msgb_push(msg, 1) = chan_nr;
+ /* Take ownership of msg, since we are keeping it around in this layer: */
+ talloc_steal(tall_lapd_ctx, msg);
msgb_enqueue(&dl->tx_ui_queue, msg);
return 0;
}
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/39808?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: Iba7b11bd9541c883588f34df67fdd865d72710d7
Gerrit-Change-Number: 39808
Gerrit-PatchSet: 3
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
pespin has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/39807?usp=email )
Change subject: lapd: Take talloc msgb ownership when enqueueing it
......................................................................
lapd: Take talloc msgb ownership when enqueueing it
Otherwise the msg talloc reference is kept parented at some unknown
pointer in some unknown upper layer, which may cause memory corruption
or use-after-free.
Related: OS#6728
Change-Id: I32729060b5a18576310b3789da522f4392d9611e
---
M src/isdn/lapd_core.c
1 file changed, 2 insertions(+), 0 deletions(-)
Approvals:
pespin: Looks good to me, approved
Jenkins Builder: Verified
diff --git a/src/isdn/lapd_core.c b/src/isdn/lapd_core.c
index b32ed26..caaf092 100644
--- a/src/isdn/lapd_core.c
+++ b/src/isdn/lapd_core.c
@@ -1922,6 +1922,8 @@
LOGDL(dl, LOGL_INFO, "writing message to send-queue: l3len: %d\n", msgb_l3len(msg));
+ /* Take ownership of msg, since we are keeping it around in this layer: */
+ talloc_steal(tall_lapd_ctx, msg);
/* Write data into the send queue */
msgb_enqueue(&dl->send_queue, msg);
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/39807?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: I32729060b5a18576310b3789da522f4392d9611e
Gerrit-Change-Number: 39807
Gerrit-PatchSet: 4
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de>
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
Attention is currently required from: fixeria, laforge, pespin.
Hello Jenkins Builder, fixeria, laforge,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/libosmocore/+/39808?usp=email
to look at the new patch set (#3).
The following approvals got outdated and were removed:
Code-Review+1 by fixeria, Code-Review+1 by laforge, Verified+1 by Jenkins Builder
Change subject: lapdm: Take talloc msgb ownership when enqueueing it
......................................................................
lapdm: Take talloc msgb ownership when enqueueing it
Otherwise the msg talloc reference is kept parented at some unknown
pointer in some unknown upper layer, which may cause memory corruption
or use-after-free.
Change-Id: Iba7b11bd9541c883588f34df67fdd865d72710d7
Related: OS#6728
---
M src/gsm/lapdm.c
1 file changed, 4 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/08/39808/3
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/39808?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: Iba7b11bd9541c883588f34df67fdd865d72710d7
Gerrit-Change-Number: 39808
Gerrit-PatchSet: 3
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Attention is currently required from: daniel, fixeria, laforge, osmith.
Hello Jenkins Builder, daniel, fixeria, laforge, osmith,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/libosmocore/+/39807?usp=email
to look at the new patch set (#4).
The following approvals got outdated and were removed:
Code-Review+1 by laforge, Verified+1 by Jenkins Builder
Change subject: lapd: Take talloc msgb ownership when enqueueing it
......................................................................
lapd: Take talloc msgb ownership when enqueueing it
Otherwise the msg talloc reference is kept parented at some unknown
pointer in some unknown upper layer, which may cause memory corruption
or use-after-free.
Related: OS#6728
Change-Id: I32729060b5a18576310b3789da522f4392d9611e
---
M src/isdn/lapd_core.c
1 file changed, 2 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/07/39807/4
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/39807?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: I32729060b5a18576310b3789da522f4392d9611e
Gerrit-Change-Number: 39807
Gerrit-PatchSet: 4
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de>
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Attention: osmith <osmith(a)sysmocom.de>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Attention: daniel <dwillmann(a)sysmocom.de>
Attention is currently required from: fixeria, laforge, pespin.
Hello Jenkins Builder, fixeria, laforge,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/libosmocore/+/39812?usp=email
to look at the new patch set (#2).
The following approvals got outdated and were removed:
Code-Review+1 by fixeria, Code-Review+1 by laforge, Verified+1 by Jenkins Builder
Change subject: lapdm: Move queue initialization to specific init function
......................................................................
lapdm: Move queue initialization to specific init function
Change-Id: I9c73f3aa5cc39d298296a82a99fbaf234b0ebe99
Related: OS#6728
---
M src/gsm/lapdm.c
1 file changed, 1 insertion(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/12/39812/2
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/39812?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: I9c73f3aa5cc39d298296a82a99fbaf234b0ebe99
Gerrit-Change-Number: 39812
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>