Leak/Double-free handling in SGSN

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/OpenBSC@lists.osmocom.org/.

Holger Hans Peter Freyther holger at freyther.de
Tue Mar 26 20:26:50 UTC 2013


On Mon, Mar 11, 2013 at 01:07:50AM +0100, Holger Hans Peter Freyther wrote:
> Hi,
> 
> I was discussing this crash[1] with Jan at the 29C3 and recently in
> Iceland. On top of that Katarina pointed me to the best practises[2]
> of talloc. In general I disagree with them[3] but they provide a nice
> solution for the SGSN/MSGB ownership issue.

Hi,

so attached is a proof of concept. This has only been compile tested.
In theory the code should now:

1.) Place the msgb in the write_queue when it will be stolen back into
the msgb context (it could be moved into a write queue context)

2.) Delete the msgb in case of error on the way down there..

3.) Catch all and the msgb is still in the local_ctx and we just free it.

Please comment.

	holger
-------------- next part --------------
A non-text attachment was scrubbed...
Name: libosmocore_steal.diff
Type: text/x-diff
Size: 736 bytes
Desc: not available
URL: <http://lists.osmocom.org/pipermail/openbsc/attachments/20130326/69499320/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sgsn_steal.diff
Type: text/x-diff
Size: 1171 bytes
Desc: not available
URL: <http://lists.osmocom.org/pipermail/openbsc/attachments/20130326/69499320/attachment-0001.bin>


More information about the OpenBSC mailing list