Andrei G has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/43587?usp=email )

Change subject: sgsn: vty: guard NULL iu.ue_ctx when dumping ......................................................................

sgsn: vty: guard NULL iu.ue_ctx when dumping

vty_dump_mmctx() reads mm->iu.ue_ctx->conn_id without checking the pointer whenever mm->ran_type is MM_CTX_T_UTRAN_Iu.

iu.ue_ctx is NULL for an attached subscriber whose Iu connection has been released. Both paths that do it leave the MM context in place and only clear the pointer: sgsn_mm_ctx_iu_ranap_release_free() and sgsn_mm_ctx_iu_ranap_free() in mmctx.c both end with "mmctx->iu.ue_ctx = NULL". Both also open with "if (!mmctx->iu.ue_ctx) return", so the rest of the file already treats a live MM context with no ue_ctx as an ordinary state. Releasing the Iu connection on inactivity while the subscriber stays attached is standard behaviour, so this is reachable in normal operation, not only after an error.

Any "show mm-context" command then dereferences NULL and takes osmo-sgsn down with it. This was hit during Iu integration testing, after a completed GMM Attach followed by an Iu release.

Guard the read. The connection id stays 0 when there is no connection, which is what the Gb branch already does for an unset TLLI. The MM state printed just below comes from iu.mm_state_fsm, which is untouched by the release, so the line still reports PMM-IDLE and no information is lost.

Change-Id: I19d380401edcdce18586ed9de26cfe85c925c1f2 Signed-off-by: Andrei Gosman andrei.gosman@gmail.com --- M src/sgsn/sgsn_vty.c 1 file changed, 5 insertions(+), 1 deletion(-)

git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/87/43587/1

diff --git a/src/sgsn/sgsn_vty.c b/src/sgsn/sgsn_vty.c index ff14589..3d8a3bd 100644 --- a/src/sgsn/sgsn_vty.c +++ b/src/sgsn/sgsn_vty.c @@ -666,7 +666,11 @@ switch(mm->ran_type) { case MM_CTX_T_UTRAN_Iu: #if BUILD_IU - id = mm->iu.ue_ctx->conn_id; + /* The Iu connection can be released while the MM context stays + * attached, which leaves iu.ue_ctx NULL; there is no connection + * id to show then. The MM state below still reports PMM-IDLE. */ + if (mm->iu.ue_ctx) + id = mm->iu.ue_ctx->conn_id; mm_state_name = osmo_fsm_inst_state_name(mm->iu.mm_state_fsm); #endif break;