[PATCH] e1: Memory leak/Reference leak on the e1inp_line

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/OpenBSC@lists.osmocom.org/.

Pablo Neira Ayuso pablo at gnumonks.org
Wed Aug 22 17:38:40 UTC 2012


On Tue, Aug 21, 2012 at 09:20:54AM +0200, Holger Hans Peter Freyther wrote:
> On Tue, Aug 21, 2012 at 03:10:32AM +0200, Pablo Neira Ayuso wrote:
> > Hi Holger,
> 
> Hi Pablo,
> 
> > IIRC, the refcnt becomes 2 if both the OML and RSL links are up.
> 
> hehe, not really sure. The _rsl_cb will will clone the e1inp_line
> but I think after we know which BTS is making the connection we
> throw away the cloned line and _get_line the OML one.
> 
> > With your patch, the refcount becomes zero after the two
> > e1inp_sign_link_destroy calls that happen in ->sign_link_down. Thus,
> > releasing the line that we were leaking.
> 
> Sounds plausible. Luckily you only free the link when it becomes
> 0 (and not smaller). I am going to add an assertion for >= 0 for
> the refcount.

Hm, I'm looking again at the last patch I sent and it's not correct
either.

If we call ipaccess_drop, all signalling links are released since
e1inp_sign_link_destroy destroys all sockets (it calls
ipaccess_close).

So, your patch is almost right. We have to e1inp_line_put in
e1inp_sign_link_destroy. But we have to remove e1inp_line_put in the
ipaccess and hsl drivers.

I'll resend a patch for this.




More information about the OpenBSC mailing list