Skip to content
Failed

Changes

Summary

  1. Fix double free during RAU with unexpected Old RAI (details)
Commit c14f2429ab71e0a36bfa420a0ca66d26e673658e by Oliver Smith
Fix double free during RAU with unexpected Old RAI

If an MS which had an MMCTX at the SGSN sent RAU update with an
unexpected Old RA field, the RAU was rejected and LLME (LLC layer)
unassigned (freed), because no MMCTX was found matching the wrong old
RA.
However, an MMCTX may actually exist pointing to that LLME, and hence
when the LLME is freed, it stayed unnoticed with a dangling pointer to
the freed LLME in ctx->gb.llme.
Let's try to harder to avoid this kind of bugs which make osmo-sgsn
crash.

Once we properly split the code into separate independent layers (LLC,
MMCTX, etc.) each holding their own structs, this kind of bugs shouldn't
happen anymore.

Related: OS#6441
Change-Id: I5a4328c6e945b85dd815215724feecadba59c435
(cherry picked from commit 868d818e6e9c39fcd4acb362708dc162cb4ee7f4)
The file was modifiedsrc/sgsn/mmctx.c
The file was modifiedinclude/osmocom/sgsn/mmctx.h
The file was modifiedsrc/sgsn/gprs_gmm.c