aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@soleta.eu>2014-08-28 19:59:15 +0200
committerPablo Neira Ayuso <pablo@soleta.eu>2014-08-28 20:00:06 +0200
commitc7f110fe73cda7977477490c8b2e63d18dfd659d (patch)
tree430874b502ee9a38511748daee3fc814c3ecf99f /src
parentbf42dd6b23d8b3ad486bfebc48717860b7b996da (diff)
osmux: stop batch timer in osmux_xfrm_input_fini()
Make sure we don't release a osmux handle with an armed batch timer. ==9753== Invalid read of size 4 ==9753== at 0x4043CA2: rb_first (rbtree.c:293) ==9753== by 0x403E172: osmo_timers_check (timer.c:256) ==9753== by 0x403E69E: osmo_select_main (select.c:124) ==9753== by 0x804EBD3: main (bsc_nat.c:1613) ==9753== Address 0x4302670 is 56 bytes inside a block of size 108 free'd ==9753== at 0x4023B6A: free (vg_replace_malloc.c:366) ==9753== by 0x40494CF: talloc_free (talloc.c:609) ==9753== by 0x40AB279: osmux_xfrm_input_fini (osmux.c:620) ==9753== by 0x80651FC: osmux_disable_endpoint (mgcp_osmux.c:96) ==9753== by 0x805CAFF: mgcp_release_endp (mgcp_protocol.c:1540) ==9753== by 0x805DD35: handle_delete_con (mgcp_protocol.c:1274) ==9753== by 0x805E998: mgcp_handle_message (mgcp_protocol.c:415) ==9753== by 0x804CFF1: mgcp_do_read (bsc_mgcp_utils.c:972) ==9753== by 0x403F96D: osmo_wqueue_bfd_cb (write_queue.c:48) ==9753== by 0x403E724: osmo_select_main (select.c:158) ==9753== by 0x804EBD3: main (bsc_nat.c:1613)
Diffstat (limited to 'src')
-rw-r--r--src/osmux.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/src/osmux.c b/src/osmux.c
index 0a7fa6e..828ed3b 100644
--- a/src/osmux.c
+++ b/src/osmux.c
@@ -617,6 +617,7 @@ void osmux_xfrm_input_fini(struct osmux_in_handle *h)
llist_del(&node->head);
talloc_free(node);
}
+ osmo_timer_del(&batch->timer);
talloc_free(batch);
}