From: Sylvain Munaut <tnt(a)246tNt.com>
Multiple CM SERVICE REQUEST can happen on a single RR
connection, in this case, since the subscr reference is
tracked through lchan->subscr and will only be put'd once
on lchan_free, we need to make sure we don't get several
reference ....
Signed-off-by: Sylvain Munaut <tnt(a)246tNt.com>
---
openbsc/src/gsm_04_08.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/openbsc/src/gsm_04_08.c b/openbsc/src/gsm_04_08.c
index 5fea6bf..f87b335 100644
--- a/openbsc/src/gsm_04_08.c
+++ b/openbsc/src/gsm_04_08.c
@@ -1343,7 +1343,9 @@ static int gsm48_rx_mm_serv_req(struct msgb *msg)
if (!msg->lchan->subscr)
msg->lchan->subscr = subscr;
- else if (msg->lchan->subscr != subscr) {
+ else if (msg->lchan->subscr == subscr)
+ subscr_put(subscr); /* lchan already has a ref, don't need another one */
+ else {
DEBUGP(DMM, "<- CM Channel already owned by someone else?\n");
subscr_put(subscr);
}
--
1.6.5.1