From: Sylvain Munaut tnt@246tNt.com
Multiple CM SERVICE REQUEST can happen on a single RR connection, in this case, since the subscr reference is tracked through lchan->subscr and will only be put'd once on lchan_free, we need to make sure we don't get several reference ....
Signed-off-by: Sylvain Munaut tnt@246tNt.com --- openbsc/src/gsm_04_08.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/openbsc/src/gsm_04_08.c b/openbsc/src/gsm_04_08.c index 5fea6bf..f87b335 100644 --- a/openbsc/src/gsm_04_08.c +++ b/openbsc/src/gsm_04_08.c @@ -1343,7 +1343,9 @@ static int gsm48_rx_mm_serv_req(struct msgb *msg)
if (!msg->lchan->subscr) msg->lchan->subscr = subscr; - else if (msg->lchan->subscr != subscr) { + else if (msg->lchan->subscr == subscr) + subscr_put(subscr); /* lchan already has a ref, don't need another one */ + else { DEBUGP(DMM, "<- CM Channel already owned by someone else?\n"); subscr_put(subscr); }