Attention is currently required from: daniel, fixeria, laforge, osmith.

pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/40327?usp=email )

Change subject: asp: Avoid double-free of received msg if conn is teared down ......................................................................

Patch Set 3:

(1 comment)

Patchset:

PS2:

This looks very similar to https://osmocom.org/issues/6728 (use-after-free/double-free in osmo-bts). […]

So what's the root problem according to you?

IMO the root problem is that stream_srv is the talloc parent of the msgb being dispatched over its read_cb() (which is legit) and we are operating it in an incorrect way here, by not taking that into account.

We simply didn't take into consideration this fact when we (I?) moved the code to the new osmo_stream_srv iofd-based API.