fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/40221?usp=email )
Change subject: lapd: Take talloc msgb ownership when enqueueing it
......................................................................
lapd: Take talloc msgb ownership when enqueueing it
Otherwise the msg talloc reference is kept parented at some unknown
pointer in some unknown upper layer, which may cause memory corruption
or use-after-free.
Related: OS#6728
Change-Id: I32729060b5a18576310b3789da522f4392d9611e
(cherry picked from commit 630d9b81c8464a0e859dd6c5c72ab88a00b61841)
---
M src/isdn/lapd_core.c
1 file changed, 2 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/21/40221/1
diff --git a/src/isdn/lapd_core.c b/src/isdn/lapd_core.c
index b32ed26..caaf092 100644
--- a/src/isdn/lapd_core.c
+++ b/src/isdn/lapd_core.c
@@ -1922,6 +1922,8 @@
LOGDL(dl, LOGL_INFO, "writing message to send-queue: l3len: %d\n", msgb_l3len(msg));
+ /* Take ownership of msg, since we are keeping it around in this layer: */
+ talloc_steal(tall_lapd_ctx, msg);
/* Write data into the send queue */
msgb_enqueue(&dl->send_queue, msg);
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/40221?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: libosmocore
Gerrit-Branch: rel-1.11.1
Gerrit-Change-Id: I32729060b5a18576310b3789da522f4392d9611e
Gerrit-Change-Number: 40221
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-CC: pespin <pespin(a)sysmocom.de>
fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/40222?usp=email )
Change subject: lapdm: Take talloc msgb ownership when enqueueing it
......................................................................
lapdm: Take talloc msgb ownership when enqueueing it
Otherwise the msg talloc reference is kept parented at some unknown
pointer in some unknown upper layer, which may cause memory corruption
or use-after-free.
Change-Id: Iba7b11bd9541c883588f34df67fdd865d72710d7
Related: OS#6728
(cherry picked from commit 9affae763e296d99eaefa0df59c4020146881bb8)
---
M src/gsm/lapdm.c
1 file changed, 4 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/22/40222/1
diff --git a/src/gsm/lapdm.c b/src/gsm/lapdm.c
index 1fc986d..3a0e29b 100644
--- a/src/gsm/lapdm.c
+++ b/src/gsm/lapdm.c
@@ -376,6 +376,8 @@
*msgb_push(msg, 1) = pad;
*msgb_push(msg, 1) = link_id;
*msgb_push(msg, 1) = chan_nr;
+ /* Take ownership of msg, since we are keeping it around in this layer: */
+ talloc_steal(tall_lapd_ctx, msg);
msgb_enqueue(&dl->dl.tx_queue, msg);
return 0;
}
@@ -403,6 +405,8 @@
*msgb_push(msg, 1) = pad;
*msgb_push(msg, 1) = link_id;
*msgb_push(msg, 1) = chan_nr;
+ /* Take ownership of msg, since we are keeping it around in this layer: */
+ talloc_steal(tall_lapd_ctx, msg);
msgb_enqueue(&dl->tx_ui_queue, msg);
return 0;
}
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/40222?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: libosmocore
Gerrit-Branch: rel-1.11.1
Gerrit-Change-Id: Iba7b11bd9541c883588f34df67fdd865d72710d7
Gerrit-Change-Number: 40222
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-CC: pespin <pespin(a)sysmocom.de>
fixeria has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/40187?usp=email )
Change subject: vty: remove broken 'show startup-config' command
......................................................................
Patch Set 1:
(1 comment)
Commit Message:
https://gerrit.osmocom.org/c/libosmocore/+/40187/comment/e5e43cd0_14cf22c8?… :
PS1, Line 12: If
> > Doesn't that mean that the write is then broken? […]
Here is an RFC:
https://gerrit.osmocom.org/c/libosmocore/+/40219
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/40187?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: If0b4a79052c060cad963e6458b29000a979f95ba
Gerrit-Change-Number: 40187
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-CC: laforge <laforge(a)osmocom.org>
Gerrit-Comment-Date: Tue, 06 May 2025 09:11:45 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: laforge <laforge(a)osmocom.org>
Comment-In-Reply-To: fixeria <vyanitskiy(a)sysmocom.de>