pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-bsc/+/42147?usp=email )
Change subject: assignment_fsm: Fix use-after-free of lchan->conn
......................................................................
assignment_fsm: Fix use-after-free of lchan->conn
Scenario:
* A DYNAMIC/OSMOCOM TS in PDCH mode is selected to be used for TCH/F,
hence the TS is being switched to TCH/F: RF Channel Release is being
transmitted and waiting to receive RF Channel release ACK. Hence,
lchan is in state LCHAN_ST_WAIT_TS_READY, and there's a conn with an
assignment FSM pointing to it in conn->assignment.new_lchan.
lchan->conn also points to the related conn.
* The BSSMAP SCCP link goes down (link lost), which will terminate the
conn->fi of all conns related to the MSC peer going down.
During that teardown, first gscon_pre_term()->gscon_release_lchans()->
assignment_reset() is called, which sets
conn->assignment.new_lchan=NULL and calls lchan_release(). This path
leaves conn->assignment.new_lchan->conn untouched!
* Later in the call path, when finally the bsc_subscr is put() to 0
references and associated lchan gets its lchan_forget_conn() called,
it will access lchan->conn which was not freed in the previous step
mentioned above during assignment_reset().
This patch fixes the issue by adding a lchan_forget_conn() after the
lchan_release() in assignment_reset(), to make sure the conn is no
longer user by the lchan afterwards.
Related: OS#6936
Change-Id: Ifbb9a61cd8a40d953ef5c2b52f9be9ef0dffefa4
(cherry picked from commit 44efd5b20b50ab894ed32ada3340fb5507b4852b)
---
M src/osmo-bsc/assignment_fsm.c
1 file changed, 1 insertion(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/47/42147/1
diff --git a/src/osmo-bsc/assignment_fsm.c b/src/osmo-bsc/assignment_fsm.c
index 4c54632..acb4e4e 100644
--- a/src/osmo-bsc/assignment_fsm.c
+++ b/src/osmo-bsc/assignment_fsm.c
@@ -127,6 +127,7 @@
struct gsm_lchan *lchan = conn->assignment.new_lchan;
conn->assignment.new_lchan = NULL;
lchan_release(lchan, false, true, RSL_ERR_EQUIPMENT_FAIL, NULL);
+ lchan_forget_conn(lchan);
}
if (conn->assignment.created_ci_for_msc) {
--
To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42147?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: osmo-bsc
Gerrit-Branch: pespin/rel-1.14.0
Gerrit-Change-Id: Ifbb9a61cd8a40d953ef5c2b52f9be9ef0dffefa4
Gerrit-Change-Number: 42147
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Attention is currently required from: laforge, osmith.
pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42144?usp=email )
Change subject: 5gc: Introduce test TC_connection_suspend
......................................................................
Patch Set 1:
(1 comment)
File 5gc/expected-results.xml:
https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42144/comment/72792291_643c… :
PS1, Line 23: C5G_Tests.ttcn:601 TC_connection_suspend testcase
> mask the other line number as well? […]
Done
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42144?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: I6da2571518a9b50369fa8e0dd19e447137ea20c6
Gerrit-Change-Number: 42144
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Attention: osmith <osmith(a)sysmocom.de>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Comment-Date: Thu, 19 Feb 2026 09:41:55 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: osmith <osmith(a)sysmocom.de>
Attention is currently required from: laforge, osmith, pespin.
Hello Jenkins Builder, laforge, osmith,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42144?usp=email
to look at the new patch set (#2).
The following approvals got outdated and were removed:
Code-Review+1 by laforge, Code-Review+1 by osmith, Verified+1 by Jenkins Builder
Change subject: 5gc: Introduce test TC_connection_suspend
......................................................................
5gc: Introduce test TC_connection_suspend
The test is expected to fail because open5gs (as of v2.7.3) doesn't
implement such features; see open5gs ticket referenced below.
Related: SYS#7073
Related: open5gs GH#4322
Change-Id: I6da2571518a9b50369fa8e0dd19e447137ea20c6
---
M 5gc/C5G_Tests.ttcn
M 5gc/ConnHdlr.ttcn
M 5gc/expected-results.xml
M library/ngap/NGAP_EncDec.cc
M library/ngap/NGAP_Types.ttcn
5 files changed, 95 insertions(+), 2 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/44/42144/2
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42144?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: I6da2571518a9b50369fa8e0dd19e447137ea20c6
Gerrit-Change-Number: 42144
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Attention: osmith <osmith(a)sysmocom.de>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>