Change in osmo-pcu[master]: coverity: fix null deref from recent UL TBF leak fix

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at

laforge gerrit-no-reply at
Thu Aug 19 14:51:42 UTC 2021

laforge has submitted this change. ( )

Change subject: coverity: fix null deref from recent UL TBF leak fix

coverity: fix null deref from recent UL TBF leak fix

Fix a possible NULL deref, introduced in recent patch
I8ce21be6836549b47a606c00b793d6f005964c5c /

Related: OS#5205 SYS#5561 CID#239246
Change-Id: I603d4a5bc0fe5bd2e9f0dba171604c459e38aeaf
M src/bts.cpp
1 file changed, 6 insertions(+), 3 deletions(-)

  Jenkins Builder: Verified
  fixeria: Looks good to me, but someone else must approve
  dexter: Looks good to me, approved

diff --git a/src/bts.cpp b/src/bts.cpp
index b5fdfee..a40e071 100644
--- a/src/bts.cpp
+++ b/src/bts.cpp
@@ -1162,13 +1162,16 @@
 	struct gprs_rlcmac_pdch *pdch = &bts->trx[trx_no].pdch[ts];
 	struct pdch_ulc_node *poll = pdch_ulc_get_node(pdch->ulc, fn);
-	struct gprs_rlcmac_ul_tbf *ul_tbf = as_ul_tbf(poll->tbf_poll.poll_tbf);
+	struct gprs_rlcmac_ul_tbf *ul_tbf;
 	if (!poll || poll->type !=PDCH_ULC_NODE_TBF_POLL ||
-	    poll->tbf_poll.poll_tbf->direction != GPRS_RLCMAC_UL_TBF)
+	    poll->tbf_poll.poll_tbf->direction != GPRS_RLCMAC_UL_TBF) {
 		LOGP(DL1IF, LOGL_DEBUG, "[%s] update TA = %u ignored due to "
 		     "unknown UL TBF on TRX = %d, TS = %d, FN = %d\n",
 		     p, ta, trx_no, ts, fn);
-	else if (ul_tbf) {
+		return;
+	}
+	ul_tbf = as_ul_tbf(poll->tbf_poll.poll_tbf);
+	if (ul_tbf) {
 		/* we need to distinguish TA information provided by L1
 		 * from PH-DATA-IND and PHY-RA-IND so that we can properly
 		 * update TA for given TBF

To view, visit
To unsubscribe, or for help writing mail filters, visit

Gerrit-Project: osmo-pcu
Gerrit-Branch: master
Gerrit-Change-Id: I603d4a5bc0fe5bd2e9f0dba171604c459e38aeaf
Gerrit-Change-Number: 25203
Gerrit-PatchSet: 1
Gerrit-Owner: neels <nhofmeyr at>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: dexter <pmaier at>
Gerrit-Reviewer: fixeria <vyanitskiy at>
Gerrit-Reviewer: laforge <laforge at>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the gerrit-log mailing list