pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-abis/+/38969?usp=email ) Change subject: e1_input: Guard against crash by users calling reentrant e1inp_sign_link_destroy() ...................................................................... e1_input: Guard against crash by users calling reentrant e1inp_sign_link_destroy() Related: osmo-bsc.git Change-Id Ice71b3143f167482e4a23759012b58e9ee13bfc0 Related: osmo-bts.git Change-Id Ibc06cdc2d2cd2028b7676fa0c3211ae251cca587 Change-Id: Ib761cece68f1d809e27194bc5cc2eb15ad2ae4eb --- M src/e1_input.c 1 file changed, 11 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-abis refs/changes/69/38969/1 diff --git a/src/e1_input.c b/src/e1_input.c index 76adbd9..066a572 100644 --- a/src/e1_input.c +++ b/src/e1_input.c @@ -810,7 +810,17 @@ { struct msgb *msg; - llist_del(&link->list); + /* Catch upper layers behaving wrongly, calling e1inp_sign_link_destroy() + * and then during the driver->close() callback below ending up calling + * this function again deeper in the call stack in the same code path. */ + if (llist_empty(&link->list)) { + LOGP(DLINP, LOGL_ERROR, "Fix your application, " + "caught reentrant e1inp_sign_link_destroy(%p)!\n", link); + return; + } + /* Use llist_del_init() to catch double destroy above: */ + llist_del_init(&link->list); + while (!llist_empty(&link->tx_list)) { msg = msgb_dequeue(&link->tx_list); msgb_free(msg); -- To view, visit https://gerrit.osmocom.org/c/libosmo-abis/+/38969?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-abis Gerrit-Branch: master Gerrit-Change-Id: Ib761cece68f1d809e27194bc5cc2eb15ad2ae4eb Gerrit-Change-Number: 38969 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin@sysmocom.de>