This is merely a historical archive of years 2008-2021, before the migration to mailman3.
A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.
neels gerrit-no-reply at lists.osmocom.orgneels has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-mgw/+/15838 )
Change subject: endpoint FSM: allow cancelling a notify event
......................................................................
endpoint FSM: allow cancelling a notify event
There is a use-after-free problem if a 'notify' FSM as passed to
osmo_mgcpc_ep_ci_request() deallocates before the notify event has been
dispatched. To avoid that, add API to allow cancelling a notify.
Change-Id: I41687d7f3a808587ab7f7520f46dcc3c29cff92d
---
M include/osmocom/mgcp_client/mgcp_client_endpoint_fsm.h
M src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c
2 files changed, 82 insertions(+), 20 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-mgw refs/changes/38/15838/1
diff --git a/include/osmocom/mgcp_client/mgcp_client_endpoint_fsm.h b/include/osmocom/mgcp_client/mgcp_client_endpoint_fsm.h
index d77371a..736da22 100644
--- a/include/osmocom/mgcp_client/mgcp_client_endpoint_fsm.h
+++ b/include/osmocom/mgcp_client/mgcp_client_endpoint_fsm.h
@@ -29,6 +29,9 @@
uint32_t event_success, uint32_t event_failure,
void *notify_data);
+void osmo_mgcpc_ep_cancel_notify(struct osmo_mgcpc_ep *ep, struct osmo_fsm_inst *notify);
+struct osmo_mgcpc_ep *osmo_mgcpc_ep_ci_ep(struct osmo_mgcpc_ep_ci *ci);
+
/*! Dispatch a DLCX for the given connection.
* \param ci Connection identifier as obtained from osmo_mgcpc_ep_ci_add().
*/
diff --git a/src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c b/src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c
index 3ea1492..2259788 100644
--- a/src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c
+++ b/src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c
@@ -73,6 +73,14 @@
static struct osmo_fsm osmo_mgcpc_ep_fsm;
+struct fsm_notify {
+ struct llist_head entry;
+ struct osmo_fsm_inst *fi;
+ uint32_t success;
+ uint32_t failure;
+ void *data;
+};
+
/*! One connection on an endpoint, corresponding to a connection identifier (CI) as returned by the MGW.
* An endpoint has a fixed number of slots of these, which may or may not be in use.
*/
@@ -87,10 +95,7 @@
bool sent;
enum mgcp_verb verb;
struct mgcp_conn_peer verb_info;
- struct osmo_fsm_inst *notify;
- uint32_t notify_success;
- uint32_t notify_failure;
- void *notify_data;
+ struct fsm_notify notify;
bool got_port_info;
struct mgcp_conn_peer rtp_info;
@@ -118,6 +123,10 @@
/*! Endpoint connection slots. Note that each connection has its own set of FSM event numbers to signal success
* and failure, depending on its index within this array. See CI_EV_SUCCESS and CI_EV_FAILURE. */
struct osmo_mgcpc_ep_ci ci[USABLE_CI];
+
+ /*! Internal use: if a function keeps an fsm_notify for later dispatch while already clearing or re-using the
+ * ci[], the fsm_notify should be kept here to also get canceled by osmo_mgcpc_ep_cancel_notify(). */
+ struct llist_head background_notify;
};
const struct value_string osmo_mgcp_verb_names[] = {
@@ -296,6 +305,7 @@
.fi = fi,
.T_defs = T_defs,
};
+ INIT_LLIST_HEAD(&ep->background_notify);
fi->priv = ep;
va_start(ap, endpoint_str_fmt);
@@ -354,15 +364,20 @@
static void on_failure(struct osmo_mgcpc_ep_ci *ci)
{
- struct osmo_fsm_inst *notify = ci->notify;
- uint32_t notify_failure = ci->notify_failure;
- void *notify_data = ci->notify_data;
struct osmo_mgcpc_ep *ep = ci->ep;
+ struct fsm_notify notify;
int i;
if (!ci->occupied)
return;
+ /* When dispatching an event for this CI, the user may decide to trigger the next request for this conn right
+ * away. So we must be ready with a cleared *ci. Store the notify separately and clear before dispatching. */
+ notify = ci->notify;
+ /* Register the planned notification in ep->background_notify so we also catch any osmo_mgcpc_ep_cancel_notify()
+ * that might be triggered between clearing the ci and actually dispatching the event. */
+ llist_add(¬ify.entry, &ep->background_notify);
+
*ci = (struct osmo_mgcpc_ep_ci){
.ep = ci->ep,
};
@@ -387,11 +402,15 @@
/* If this check has terminated the FSM instance, don't fire any more events to prevent use-after-free problems.
* The endpoint FSM does dispatch a term event to its parent, and everything should be cleaned like that. */
- if (!osmo_mgcpc_ep_fsm_check_state_chg_after_response(ci->ep->fi))
+ if (!osmo_mgcpc_ep_fsm_check_state_chg_after_response(ep->fi)) {
+ /* The ep has deallocated, no need to llist_del(¬ify.entry) here. */
return;
+ }
- if (notify)
- osmo_fsm_inst_dispatch(notify, notify_failure, notify_data);
+ if (notify.fi)
+ osmo_fsm_inst_dispatch(notify.fi, notify.failure, notify.data);
+
+ llist_del(¬ify.entry);
}
static int update_endpoint_name(struct osmo_mgcpc_ep_ci *ci, const char *new_endpoint_name)
@@ -472,10 +491,10 @@
LOG_CI(ci, LOGL_DEBUG, "received successful response to %s: RTP=%s%s\n",
osmo_mgcp_verb_name(ci->verb),
mgcp_conn_peer_name(ci->got_port_info? &ci->rtp_info : NULL),
- ci->notify ? "" : " (not sending a notification)");
+ ci->notify.fi ? "" : " (not sending a notification)");
- if (ci->notify)
- osmo_fsm_inst_dispatch(ci->notify, ci->notify_success, ci->notify_data);
+ if (ci->notify.fi)
+ osmo_fsm_inst_dispatch(ci->notify.fi, ci->notify.success, ci->notify.data);
osmo_mgcpc_ep_fsm_check_state_chg_after_response(ci->ep->fi);
}
@@ -536,6 +555,11 @@
((struct osmo_mgcpc_ep*)fi->priv)->T_defs, 5)
/*! Dispatch an actual CRCX/MDCX/DLCX message for this connection.
+ *
+ * If the 'notify' instance deallocates before it received a notification of event_success or event_failure,
+ * osmo_mgcpc_ep_ci_cancel_notify() or osmo_mgcpc_ep_cancel_notify() must be called. It is not harmful to cancel
+ * notification after an event has been received.
+ *
* \param ci Connection identifier as obtained from osmo_mgcpc_ep_ci_add().
* \param verb MGCP operation to dispatch.
* \param verb_info Parameters for the MGCP operation.
@@ -584,16 +608,18 @@
.occupied = true,
/* .pending = true follows below */
.verb = verb,
- .notify = notify,
- .notify_success = event_success,
- .notify_failure = event_failure,
- .notify_data = notify_data,
+ .notify = {
+ .fi = notify,
+ .success = event_success,
+ .failure = event_failure,
+ .data = notify_data,
+ }
};
osmo_strlcpy(cleared_ci.label, ci->label, sizeof(cleared_ci.label));
osmo_strlcpy(cleared_ci.mgcp_ci_str, ci->mgcp_ci_str, sizeof(cleared_ci.mgcp_ci_str));
*ci = cleared_ci;
- LOG_CI_VERB(ci, LOGL_DEBUG, "notify=%s\n", osmo_fsm_inst_name(ci->notify));
+ LOG_CI_VERB(ci, LOGL_DEBUG, "notify=%s\n", osmo_fsm_inst_name(ci->notify.fi));
if (verb_info)
ci->verb_info = *verb_info;
@@ -651,10 +677,39 @@
osmo_fsm_inst_dispatch(notify, event_failure, notify_data);
}
+/*! No longer notify for any state changes for any conns of this endpoint.
+ * Useful if the notify instance passed to osmo_mgcpc_ep_ci_request() is about to deallocate.
+ * \param ep The endpoint FSM instance.
+ * \param notify Which target to cancel notification for, if NULL cancel all notifications. */
+void osmo_mgcpc_ep_cancel_notify(struct osmo_mgcpc_ep *ep, struct osmo_fsm_inst *notify)
+{
+ struct fsm_notify *n;
+ int i;
+ for (i = 0; i < ARRAY_SIZE(ep->ci); i++) {
+ struct osmo_mgcpc_ep_ci *ci = &ep->ci[i];
+ if (!notify || ci->notify.fi == notify)
+ ci->notify.fi = NULL;
+ }
+ llist_for_each_entry(n, &ep->background_notify, entry) {
+ if (!notify || n->fi == notify)
+ n->fi = NULL;
+ }
+
+}
+
+/* Return the osmo_mgcpc_ep that this conn belongs to. */
+struct osmo_mgcpc_ep *osmo_mgcpc_ep_ci_ep(struct osmo_mgcpc_ep_ci *conn)
+{
+ if (!conn)
+ return NULL;
+ return conn->ep;
+}
+
static int send_verb(struct osmo_mgcpc_ep_ci *ci)
{
int rc;
struct osmo_mgcpc_ep *ep = ci->ep;
+ struct fsm_notify notify;
if (!ci->occupied || !ci->pending || ci->sent)
return 0;
@@ -693,11 +748,14 @@
osmo_mgcp_verb_name(ci->verb), ci->mgcp_ci_str);
/* The way this is designed, we actually need to forget all about the ci right away. */
mgcp_conn_delete(ci->mgcp_client_fi);
- if (ci->notify)
- osmo_fsm_inst_dispatch(ci->notify, ci->notify_success, ci->notify_data);
+ notify = ci->notify;
*ci = (struct osmo_mgcpc_ep_ci){
.ep = ep,
};
+ /* When dispatching an event for this CI, the user may decide to trigger the next request for this conn
+ * right away. So we must be ready with a cleared *ci. */
+ if (notify.fi)
+ osmo_fsm_inst_dispatch(notify.fi, notify.success, notify.data);
break;
default:
@@ -712,6 +770,7 @@
{
if (!ep)
return;
+ osmo_mgcpc_ep_cancel_notify(ep, NULL);
osmo_fsm_inst_term(ep->fi, OSMO_FSM_TERM_REGULAR, 0);
}
--
To view, visit https://gerrit.osmocom.org/c/osmo-mgw/+/15838
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-mgw
Gerrit-Branch: master
Gerrit-Change-Id: I41687d7f3a808587ab7f7520f46dcc3c29cff92d
Gerrit-Change-Number: 15838
Gerrit-PatchSet: 1
Gerrit-Owner: neels <nhofmeyr at sysmocom.de>
Gerrit-MessageType: newchange
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20191023/2cc2fd81/attachment.htm>