Change in osmo-bsc[rel-1.7.1]: assignment_fsm: Check for conn->lchan

[osmith]

osmith has submitted this change. ( https://gerrit.osmocom.org/c/osmo-bsc/+/25753 )

Change subject: assignment_fsm: Check for conn->lchan
......................................................................

assignment_fsm: Check for conn->lchan

When the SDCCH gets released while the TCH still beeing activated, then
the ChanActivACK that is received after the TCH is activated will trigger
a segmentation fault in the assignment_fsm. The reason for this is that
conn->lchan, which holds the SDCCH at that point in time, is now NULL.

To prevent osmo-bsc from crashing, the FSM should check for the presence
of conn->lchan first. If it does not exist, the FSM should terminate.
(Assignment failed)

Change-Id: I3b1cd88bea62ef0032f6c035bac95d3df9fdca7a
Related: SYS#5627
---
M src/osmo-bsc/assignment_fsm.c
1 file changed, 9 insertions(+), 0 deletions(-)

Approvals:
  Jenkins Builder: Verified
  osmith: Looks good to me, approved



diff --git a/src/osmo-bsc/assignment_fsm.c b/src/osmo-bsc/assignment_fsm.c
index 2f241e3..c5a1250 100644
--- a/src/osmo-bsc/assignment_fsm.c
+++ b/src/osmo-bsc/assignment_fsm.c
@@ -610,6 +610,15 @@
 	int rc;
 	struct gsm_subscriber_connection *conn = assignment_fi_conn(fi);
 
+	/* There may be situations where the SDCCH gets released while the TCH is still being activated. We will then
+	 * receive ChanActivAck message from the BTS when the TCH is ready. Since the SDCCH is already released by
+	 * then conn->lchan will be NULL in this case. */
+	if (!conn->lchan) {
+		assignment_fail(GSM0808_CAUSE_EQUIPMENT_FAILURE,
+				"Unable to send RR Assignment Command: conn without lchan");
+		return;
+	}
+
 	rc = gsm48_send_rr_ass_cmd(conn->lchan, conn->assignment.new_lchan,
 				   conn->lchan->ms_power);
 

-- 
To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/25753
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-bsc
Gerrit-Branch: rel-1.7.1
Gerrit-Change-Id: I3b1cd88bea62ef0032f6c035bac95d3df9fdca7a
Gerrit-Change-Number: 25753
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <vyanitskiy at sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: osmith <osmith at sysmocom.de>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20211013/3eeeec38/attachment.htm>