Change in osmo-bsc[2021q1]: assignment_fsm: Check for conn->lchan

[fixeria]

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-bsc/+/25837 )


Change subject: assignment_fsm: Check for conn->lchan
......................................................................

assignment_fsm: Check for conn->lchan

When the SDCCH gets released while the TCH still beeing activated, then
the ChanActivACK that is received after the TCH is activated will trigger
a segmentation fault in the assignment_fsm. The reason for this is that
conn->lchan, which holds the SDCCH at that point in time, is now NULL.

To prevent osmo-bsc from crashing, the FSM should check for the presence
of conn->lchan first. If it does not exist, the FSM should terminate.
(Assignment failed)

Change-Id: I3b1cd88bea62ef0032f6c035bac95d3df9fdca7a
Related: SYS#5627, OS#5255
---
M src/osmo-bsc/assignment_fsm.c
1 file changed, 9 insertions(+), 0 deletions(-)



  git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/37/25837/1

diff --git a/src/osmo-bsc/assignment_fsm.c b/src/osmo-bsc/assignment_fsm.c
index faaec53..3eda129 100644
--- a/src/osmo-bsc/assignment_fsm.c
+++ b/src/osmo-bsc/assignment_fsm.c
@@ -611,6 +611,15 @@
 	int rc;
 	struct gsm_subscriber_connection *conn = assignment_fi_conn(fi);
 
+	/* There may be situations where the SDCCH gets released while the TCH is still being activated. We will then
+	 * receive ChanActivAck message from the BTS when the TCH is ready. Since the SDCCH is already released by
+	 * then conn->lchan will be NULL in this case. */
+	if (!conn->lchan) {
+		assignment_fail(GSM0808_CAUSE_EQUIPMENT_FAILURE,
+				"Unable to send RR Assignment Command: conn without lchan");
+		return;
+	}
+
 	rc = gsm48_send_rr_ass_cmd(conn->lchan, conn->assignment.new_lchan,
 				   conn->lchan->ms_power);
 

-- 
To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/25837
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-bsc
Gerrit-Branch: 2021q1
Gerrit-Change-Id: I3b1cd88bea62ef0032f6c035bac95d3df9fdca7a
Gerrit-Change-Number: 25837
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <vyanitskiy at sysmocom.de>
Gerrit-MessageType: newchange
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20211020/d3a01e5f/attachment.htm>