jolly has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-netif/+/36125?usp=email )

Change subject: stream_{cli,srv}: Free received messages when not forwarded ......................................................................

stream_{cli,srv}: Free received messages when not forwarded

If a message is not forwarded (to a read callback function, it must be freed, to prevent memory leaks.

The message musst be freed before calling osmo_stream_srv_destroy() or stream_cli_handle_connecting(), because within the function calls the client/server instance may get destroyed and the message is 'owned' by it. Calling msgb_free(msg) afterwards may result in double free bug.

Related: OS#5753 Change-Id: Ic043f11cdba0df9e0b78cac8db7206800098e0ba --- M src/stream_cli.c M src/stream_srv.c 2 files changed, 26 insertions(+), 0 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/libosmo-netif refs/changes/25/36125/1

diff --git a/src/stream_cli.c b/src/stream_cli.c index f9e52a0..61fb4b7 100644 --- a/src/stream_cli.c +++ b/src/stream_cli.c @@ -439,6 +439,7 @@

switch (cli->state) { case STREAM_CLI_STATE_CONNECTING: + msgb_free(msg); stream_cli_handle_connecting(cli, res); break; case STREAM_CLI_STATE_CONNECTED: @@ -447,6 +448,8 @@ /* Forward message to read callback, also if the connection failed. */ if (cli->iofd_read_cb) cli->iofd_read_cb(cli, msg); + else + msgb_free(msg); break; default: osmo_panic("%s() called with unexpected state %d\n", __func__, cli->state); @@ -488,6 +491,7 @@

switch (cli->state) { case STREAM_CLI_STATE_CONNECTING: + msgb_free(msg); stream_cli_handle_connecting(cli, res); break; case STREAM_CLI_STATE_CONNECTED: @@ -496,6 +500,8 @@ /* Forward message to read callback, also if the connection failed. */ if (cli->iofd_read_cb) cli->iofd_read_cb(cli, msg); + else + msgb_free(msg); break; default: osmo_panic("%s() called with unexpected state %d\n", __func__, cli->state); diff --git a/src/stream_srv.c b/src/stream_srv.c index f82a9a0..852154a 100644 --- a/src/stream_srv.c +++ b/src/stream_srv.c @@ -562,6 +562,7 @@

if (OSMO_UNLIKELY(res <= 0)) { /* This connection is dead, destroy it. */ + msgb_free(msg); osmo_stream_srv_destroy(conn); } else { if (conn->flags & OSMO_STREAM_SRV_F_FLUSH_DESTROY) { @@ -609,6 +610,7 @@

if (OSMO_UNLIKELY(res <= 0)) { /* This connection is dead, destroy it. */ + msgb_free(msg); osmo_stream_srv_destroy(conn); } else { if (conn->flags & OSMO_STREAM_SRV_F_FLUSH_DESTROY) {