fixeria submitted this change.

View Change

trxcon: handle l1sched_config_req via TRXCON_EV_SET_PHY_CONFIG_REQ

Calling l1sched_free() from trxcon_fsm_pre_term_cb() may result in
l1sched_handle_config_req() being called when trxcon->phyif is NULL.

Handling l1sched_config_req via TRXCON_EV_SET_PHY_CONFIG_REQ guards us
against NULL pointer dereference during teardown of a trxcon_fsm
instance, if it's caused by TRXCON_EV_PHYIF_FAILURE.

Change-Id: I44bbc695e8a406a7acb9c163bf223f4ea966ea12
Related: OS#5599
---
M src/host/trxcon/include/osmocom/bb/trxcon/trxcon.h
M src/host/trxcon/src/l1ctl.c
M src/host/trxcon/src/trxcon.c
M src/host/trxcon/src/trxcon_fsm.c
4 files changed, 43 insertions(+), 11 deletions(-)

diff --git a/src/host/trxcon/include/osmocom/bb/trxcon/trxcon.h b/src/host/trxcon/include/osmocom/bb/trxcon/trxcon.h
index 2a6f7d5..99b02b6 100644
--- a/src/host/trxcon/include/osmocom/bb/trxcon/trxcon.h
+++ b/src/host/trxcon/include/osmocom/bb/trxcon/trxcon.h
@@ -63,8 +63,20 @@
 
 /* param of TRXCON_EV_SET_PHY_CONFIG_REQ */
 struct trxcon_param_set_phy_config_req {
-	uint8_t timing_advance;
-	uint8_t tx_power;
+	enum {
+		TRXCON_PHY_CFGT_PCHAN_COMB,
+		TRXCON_PHY_CFGT_TX_PARAMS,
+	} type;
+	union {
+		struct {
+			uint8_t tn;
+			uint8_t pchan;
+		} pchan_comb;
+		struct {
+			uint8_t timing_advance;
+			uint8_t tx_power;
+		} tx_params;
+	};
 };
 
 /* param of TRXCON_EV_TX_{TRAFFIC,DATA}_REQ */
diff --git a/src/host/trxcon/src/l1ctl.c b/src/host/trxcon/src/l1ctl.c
index 4d6bed2..3e23374 100644
--- a/src/host/trxcon/src/l1ctl.c
+++ b/src/host/trxcon/src/l1ctl.c
@@ -675,8 +675,11 @@
 		  par_req->ta, par_req->tx_power);
 
 	struct trxcon_param_set_phy_config_req req = {
-		.timing_advance = par_req->ta,
-		.tx_power = par_req->tx_power,
+		.type = TRXCON_PHY_CFGT_TX_PARAMS,
+		.tx_params = {
+			.timing_advance = par_req->ta,
+			.tx_power = par_req->tx_power,
+		}
 	};
 
 	osmo_fsm_inst_dispatch(trxcon->fi, TRXCON_EV_SET_PHY_CONFIG_REQ, &req);
diff --git a/src/host/trxcon/src/trxcon.c b/src/host/trxcon/src/trxcon.c
index 429d033..9e68ec5 100644
--- a/src/host/trxcon/src/trxcon.c
+++ b/src/host/trxcon/src/trxcon.c
@@ -112,9 +112,17 @@
 
 	switch (cr->type) {
 	case L1SCHED_CFG_PCHAN_COMB:
-		return trx_if_cmd_setslot(trxcon->phyif,
-					  cr->pchan_comb.tn,
-					  cr->pchan_comb.pchan);
+	{
+		struct trxcon_param_set_phy_config_req req = {
+			.type = TRXCON_PHY_CFGT_PCHAN_COMB,
+			.pchan_comb = {
+				.tn = cr->pchan_comb.tn,
+				.pchan = cr->pchan_comb.pchan,
+			},
+		};
+
+		return osmo_fsm_inst_dispatch(trxcon->fi, TRXCON_EV_SET_PHY_CONFIG_REQ, &req);
+	}
 	default:
 		LOGPFSML(trxcon->fi, LOGL_ERROR,
 			 "Unhandled config request (type 0x%02x)\n", cr->type);
diff --git a/src/host/trxcon/src/trxcon_fsm.c b/src/host/trxcon/src/trxcon_fsm.c
index a77ce68..b028ef4 100644
--- a/src/host/trxcon/src/trxcon_fsm.c
+++ b/src/host/trxcon/src/trxcon_fsm.c
@@ -67,10 +67,19 @@
 	{
 		const struct trxcon_param_set_phy_config_req *req = data;
 
-		if (trxcon->l1p.ta != req->timing_advance)
-			trx_if_cmd_setta(trxcon->phyif, req->timing_advance);
-		trxcon->l1p.tx_power = req->tx_power;
-		trxcon->l1p.ta = req->timing_advance;
+		switch (req->type) {
+		case TRXCON_PHY_CFGT_PCHAN_COMB:
+			trx_if_cmd_setslot(trxcon->phyif,
+					   req->pchan_comb.tn,
+					   req->pchan_comb.pchan);
+			break;
+		case TRXCON_PHY_CFGT_TX_PARAMS:
+			if (trxcon->l1p.ta != req->tx_params.timing_advance)
+				trx_if_cmd_setta(trxcon->phyif, req->tx_params.timing_advance);
+			trxcon->l1p.tx_power = req->tx_params.tx_power;
+			trxcon->l1p.ta = req->tx_params.timing_advance;
+			break;
+		}
 		break;
 	}
 	case TRXCON_EV_UPDATE_SACCH_CACHE_REQ:

To view, visit change 28863. To unsubscribe, or for help writing mail filters, visit settings.