Andrei G has uploaded this change for review.
sgsn: vty: guard NULL iu.ue_ctx when dumping
vty_dump_mmctx() reads mm->iu.ue_ctx->conn_id without checking the
pointer whenever mm->ran_type is MM_CTX_T_UTRAN_Iu.
iu.ue_ctx is NULL for an attached subscriber whose Iu connection has
been released. Both paths that do it leave the MM context in place and
only clear the pointer: sgsn_mm_ctx_iu_ranap_release_free() and
sgsn_mm_ctx_iu_ranap_free() in mmctx.c both end with
"mmctx->iu.ue_ctx = NULL". Both also open with "if (!mmctx->iu.ue_ctx)
return", so the rest of the file already treats a live MM context with
no ue_ctx as an ordinary state. Releasing the Iu connection on
inactivity while the subscriber stays attached is standard behaviour,
so this is reachable in normal operation, not only after an error.
Any "show mm-context" command then dereferences NULL and takes osmo-sgsn
down with it. This was hit during Iu integration testing, after a
completed GMM Attach followed by an Iu release.
Guard the read. The connection id stays 0 when there is no connection,
which is what the Gb branch already does for an unset TLLI. The MM
state printed just below comes from iu.mm_state_fsm, which is untouched
by the release, so the line still reports PMM-IDLE and no information
is lost.
Change-Id: I19d380401edcdce18586ed9de26cfe85c925c1f2
Signed-off-by: Andrei Gosman <andrei.gosman@gmail.com>
---
M src/sgsn/sgsn_vty.c
1 file changed, 5 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/87/43587/1
diff --git a/src/sgsn/sgsn_vty.c b/src/sgsn/sgsn_vty.c
index ff14589..3d8a3bd 100644
--- a/src/sgsn/sgsn_vty.c
+++ b/src/sgsn/sgsn_vty.c
@@ -666,7 +666,11 @@
switch(mm->ran_type) {
case MM_CTX_T_UTRAN_Iu:
#if BUILD_IU
- id = mm->iu.ue_ctx->conn_id;
+ /* The Iu connection can be released while the MM context stays
+ * attached, which leaves iu.ue_ctx NULL; there is no connection
+ * id to show then. The MM state below still reports PMM-IDLE. */
+ if (mm->iu.ue_ctx)
+ id = mm->iu.ue_ctx->conn_id;
mm_state_name = osmo_fsm_inst_state_name(mm->iu.mm_state_fsm);
#endif
break;
To view, visit change 43587. To unsubscribe, or for help writing mail filters, visit settings.