Change in osmo-bts[master]: lchan: Call lapdm_channel_exit() when state changes to NONE

[pespin]

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-bts/+/25792 )

Change subject: lchan: Call lapdm_channel_exit() when state changes to NONE
......................................................................

lchan: Call lapdm_channel_exit() when state changes to NONE

Fixes crash when TTCN3 BTS_Tests_LAPDm TC_rr_response_frame_loss
runs run after TC_t200_n200.

The BTS was shutdown after TC_t200_n200 failed (drop oml link), and
lchan was moved ACTIVE->NONE without lapdm_channel_exit() being called
on it. Hence, on next test (TC_rr_response_frame_loss), when
lchan_init_lapdm() was called again, some memory corruption was caused.

The lapdm_channel_exit can be dropped from gsm_lchan_release() and
rsl_tx_rf_rel_ack() since it's already called in the same path:
"""
rsl_rx_rf_chan_rel
	gsm_lchan_release(lchan, LCHAN_REL_ACT_RSL);
		l1sap_chan_rel(lchan->ts->trx, gsm_lchan2chan_nr(lchan));
			l1sap_chan_act_dact_modify(trx, chan_nr, PRIM_INFO_DEACTIVATE)
				bts_model_l1sap_down
					bts_model_lchan_deactivate_sacch(lchan);
						-
					lchan_deactivate(lchan);
						bts_model_lchan_deactivate
							lchan_set_state(lchan, LCHAN_S_NONE); <---------
					mph_info_chan_confirm(trx, chan_nr, PRIM_INFO_DEACTIVATE, 0);
						l1sap_info_rel_cnf
							rsl_tx_rf_rel_ack(lchan);
								lapdm_channel_exit(&lchan->lapdm_ch);
		lapdm_channel_exit(&lchan->lapdm_ch);
"""

Related: SYS#5262
Change-Id: If0ec5f0c7be4d15c8d684d33e15e24d68bd5192e
---
M src/common/lchan.c
M src/common/rsl.c
2 files changed, 11 insertions(+), 17 deletions(-)

Approvals:
  Jenkins Builder: Verified
  fixeria: Looks good to me, approved



diff --git a/src/common/lchan.c b/src/common/lchan.c
index 28ea943..a3be4ee 100644
--- a/src/common/lchan.c
+++ b/src/common/lchan.c
@@ -231,8 +231,6 @@
 	}
 
 	l1sap_chan_rel(lchan->ts->trx, gsm_lchan2chan_nr(lchan));
-
-	lapdm_channel_exit(&lchan->lapdm_ch);
 }
 
 int lchan_deactivate(struct gsm_lchan *lchan)
@@ -290,6 +288,17 @@
 					    osmo_tdef_get(abis_T_defs, -15, OSMO_TDEF_US, -1));
 		}
 		break;
+	case LCHAN_S_NONE:
+		lapdm_channel_exit(&lchan->lapdm_ch);
+		/* Also ensure that there are no leftovers from repeated FACCH or
+		 * repeated SACCH that might cause memory leakage. */
+		msgb_free(lchan->tch.rep_facch[0].msg);
+		msgb_free(lchan->tch.rep_facch[1].msg);
+		lchan->tch.rep_facch[0].msg = NULL;
+		lchan->tch.rep_facch[1].msg = NULL;
+		msgb_free(lchan->rep_sacch);
+		lchan->rep_sacch = NULL;
+		/* fall through */
 	default:
 		if (lchan->early_rr_ia) {
 			/* Early Immediate Assignment: Transition to any other
diff --git a/src/common/rsl.c b/src/common/rsl.c
index 99e8195..145cc8a 100644
--- a/src/common/rsl.c
+++ b/src/common/rsl.c
@@ -1296,21 +1296,6 @@
 	     gsm_ts_and_pchan_name(lchan->ts), lchan->nr,
 	     gsm_lchant_name(lchan->type));
 
-	/*
-	 * Free the LAPDm resources now that the BTS
-	 * has released all the resources.
-	 */
-	lapdm_channel_exit(&lchan->lapdm_ch);
-
-	/* Also ensure that there are no leftovers from repeated FACCH or
-	 * repeated SACCH that might cause memory leakage. */
-	msgb_free(lchan->tch.rep_facch[0].msg);
-	msgb_free(lchan->tch.rep_facch[1].msg);
-	lchan->tch.rep_facch[0].msg = NULL;
-	lchan->tch.rep_facch[1].msg = NULL;
-	msgb_free(lchan->rep_sacch);
-	lchan->rep_sacch = NULL;
-
 	return tx_rf_rel_ack(lchan, chan_nr);
 }
 

-- 
To view, visit https://gerrit.osmocom.org/c/osmo-bts/+/25792
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-bts
Gerrit-Branch: master
Gerrit-Change-Id: If0ec5f0c7be4d15c8d684d33e15e24d68bd5192e
Gerrit-Change-Number: 25792
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin at sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy at sysmocom.de>
Gerrit-Reviewer: pespin <pespin at sysmocom.de>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20211015/309d8506/attachment.htm>