fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/40863?usp=email )
Change subject: msc: add TC_silent_call_start_stop ......................................................................
msc: add TC_silent_call_start_stop
This testcase triggers a use-after-free in osmo-msc.
Change-Id: I3ef22fbb5a05f69cc8aea7f42e05f6e1d6c4a8b6 Related: osmo-msc.git I93913d189800d71f82c013b6e946bd63db362f65 --- M msc/MSC_Tests.ttcn M msc/expected-results.xml 2 files changed, 51 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/63/40863/1
diff --git a/msc/MSC_Tests.ttcn b/msc/MSC_Tests.ttcn index 4a7acdc..46fdd4d 100644 --- a/msc/MSC_Tests.ttcn +++ b/msc/MSC_Tests.ttcn @@ -7710,6 +7710,52 @@ setverdict(pass); }
+/* Bug reproducer for https://gerrit.osmocom.org/c/osmo-msc/+/40852. + * Start and stop a silent call while there's an active connection. */ +private function f_TC_silent_call_start_stop(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr { + var charstring cmd, resp; + + f_init_handler(pars); + + cmd := "subscriber imsi " & hex2str(g_pars.imsi) & " silent-call "; + + f_perform_lu(); + f_ran_register_imsi(g_pars.imsi, g_pars.tmsi); + + /* The MS establishes a connection (e.g. for periodic Location Updating) */ + f_establish_fully(); + + /* Meanwhile, a silent call is being initiated from the VTY */ + MSCVTY.send(cmd & "start any signalling"); + resp := f_vty_wait_for_prompt(MSCVTY); + if (resp != "% Silent call initiated") { + setverdict(fail, "VTY: Unexpected response: ", resp); + } + + /* XXX: The MSC pages the MS, even though there is an active connection?!? */ + f_expect_paging(); + + /* A silent call is being stopped from the VTY */ + MSCVTY.send(cmd & "stop"); + resp := f_vty_wait_for_prompt(MSCVTY); + if (resp != "% Silent call ended\n% Silent call stopped") { + setverdict(fail, "VTY: Unexpected response: ", resp); + } + + f_sleep(10.0); /* timer X4 is 10s */ + + /* ... osmo-msc crashes after paging timeout ... */ + + f_expect_clear(); +} +testcase TC_silent_call_start_stop() runs on MTC_CT { + var BSC_ConnHdlr vc_conn; + f_init(); + + vc_conn := f_start_handler(refers(f_TC_silent_call_start_stop), 30); + vc_conn.done; +} + control { execute( TC_cr_before_reset() ); execute( TC_lu_imsi_noauth_tmsi() ); @@ -7910,6 +7956,10 @@ if (Misc_Helpers.f_osmo_repo_is("nightly")) { execute( TC_stat_bsc_sctp_disconnected() ); } + + if (Misc_Helpers.f_osmo_repo_is("nightly")) { + execute( TC_silent_call_start_stop() ); + } }
diff --git a/msc/expected-results.xml b/msc/expected-results.xml index 7a5066d..7070662 100644 --- a/msc/expected-results.xml +++ b/msc/expected-results.xml @@ -177,6 +177,7 @@ <testcase classname='MSC_Tests' name='TC_lu_and_mt_csd' time='MASKED'/> <testcase classname='MSC_Tests' name='TC_lu_and_mo_call_reass_for_mt_codec' time='MASKED'/> <testcase classname='MSC_Tests' name='TC_stat_bsc_sctp_disconnected' time='MASKED'/> + <testcase classname='MSC_Tests' name='TC_silent_call_start_stop' time='MASKED'/> <!-- MSC_Tests_Iu testcases start here --> <testcase classname='MSC_Tests_Iu' name='TC_iu_lu_imsi_reject' time='MASKED'/> <testcase classname='MSC_Tests_Iu' name='TC_iu_lu_imsi_timeout_gsup' time='MASKED'/>
-
fixeria