Change in libosmocore[master]: gprs_ns2: free_nse: free the SNS fsm early

[lynxis lazus]

lynxis lazus has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/22966 )

Change subject: gprs_ns2: free_nse: free the SNS fsm early
......................................................................

gprs_ns2: free_nse: free the SNS fsm early

If the SNS fsm isn't freed early, the SNS code will re-create a NSVC
when calling free_nsvc().
Fixes libasan heap-use-after-free.

Change-Id: If350df1d8d6dcea5715dd23b8bd1d684098cdb1f
---
M src/gb/gprs_ns2.c
1 file changed, 5 insertions(+), 2 deletions(-)

Approvals:
  Jenkins Builder: Verified
  pespin: Looks good to me, but someone else must approve
  daniel: Looks good to me, approved



diff --git a/src/gb/gprs_ns2.c b/src/gb/gprs_ns2.c
index c48575b..a79dd05 100644
--- a/src/gb/gprs_ns2.c
+++ b/src/gb/gprs_ns2.c
@@ -831,12 +831,15 @@
 		return;
 
 	nse->alive = false;
+	if (nse->bss_sns_fi) {
+		osmo_fsm_inst_term(nse->bss_sns_fi, OSMO_FSM_TERM_REQUEST, NULL);
+		nse->bss_sns_fi = NULL;
+	}
+
 	gprs_ns2_free_nsvcs(nse);
 	ns2_prim_status_ind(nse, NULL, 0, GPRS_NS2_AFF_CAUSE_FAILURE);
 
 	llist_del(&nse->list);
-	if (nse->bss_sns_fi)
-		osmo_fsm_inst_term(nse->bss_sns_fi, OSMO_FSM_TERM_REQUEST, NULL);
 	talloc_free(nse);
 }
 

-- 
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/22966
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: If350df1d8d6dcea5715dd23b8bd1d684098cdb1f
Gerrit-Change-Number: 22966
Gerrit-PatchSet: 1
Gerrit-Owner: lynxis lazus <lynxis at fe80.eu>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: daniel <dwillmann at sysmocom.de>
Gerrit-Reviewer: laforge <laforge at osmocom.org>
Gerrit-Reviewer: lynxis lazus <lynxis at fe80.eu>
Gerrit-Reviewer: pespin <pespin at sysmocom.de>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20210219/e9acda73/attachment.htm>