diff options
| author | Holger Hans Peter Freyther <holger@moiji-mobile.com> | 2014-07-07 20:00:35 +0200 |
|---|---|---|
| committer | Holger Hans Peter Freyther <holger@moiji-mobile.com> | 2014-07-07 20:00:35 +0200 |
| commit | 777b056fb4eef1bde8ae670a360c766d26f093bf (patch) | |
| tree | 4f0da41a1e17751abef2aac3c9041583d24f222c | |
| parent | eb55e6aa88f5dfef10c86fae5377e1280cf91bf7 (diff) | |
gprs-ns: Re-initialize the list head and free the unknown_nsvc
Fix re-initialize issue of the GPRS NS. This was found while
working on the GB Proxy tests.
==27800== Invalid write of size 4
==27800== at 0x403C263: rate_ctr_group_alloc (linuxlist.h:65)
==27800== by 0x4050974: gprs_nsvc_create (gprs_ns.c:209)
==27800== by 0x405320D: gprs_ns_instantiate (gprs_ns.c:1330)
==27800== by 0x804B212: main (gbproxy_test.c:797)
==27800== Address 0x434173c is 52 bytes inside a block of size 784 free'd
==27800== at 0x4029DA8: free (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==27800== by 0x4041BBD: _talloc_free (talloc.c:609)
==27800== by 0x40432B2: talloc_free (talloc.c:578)
==27800== by 0x40532D3: gprs_ns_destroy (gprs_ns.c:1363)
==27800== by 0x804B1FE: main (gbproxy_test.c:791)
| -rw-r--r-- | src/gb/gprs_ns.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/gb/gprs_ns.c b/src/gb/gprs_ns.c index b500d9a8..ee2d7ec7 100644 --- a/src/gb/gprs_ns.c +++ b/src/gb/gprs_ns.c @@ -1330,6 +1330,7 @@ struct gprs_ns_inst *gprs_ns_instantiate(gprs_ns_cb_t *cb, void *ctx) nsi->unknown_nsvc = gprs_nsvc_create(nsi, 0xfffe); nsi->unknown_nsvc->nsvci_is_valid = 0; llist_del(&nsi->unknown_nsvc->list); + INIT_LLIST_HEAD(&nsi->unknown_nsvc->list); return nsi; } @@ -1338,6 +1339,8 @@ void gprs_ns_close(struct gprs_ns_inst *nsi) { struct gprs_nsvc *nsvc, *nsvc2; + gprs_nsvc_delete(nsi->unknown_nsvc); + /* delete all NSVCs and clear their timers */ llist_for_each_entry_safe(nsvc, nsvc2, &nsi->gprs_nsvcs, list) gprs_nsvc_delete(nsvc); |