diff options
| author | Jacob Erlbeck <jerlbeck@sysmocom.de> | 2014-09-19 09:28:42 +0200 |
|---|---|---|
| committer | Holger Hans Peter Freyther <holger@moiji-mobile.com> | 2014-10-09 17:42:23 +0200 |
| commit | 08fbeb8fa4c1097c2714e7b4b85079119aebee5b (patch) | |
| tree | 267356e6b35fda60ce035ab62c63aa36b01a432e /openbsc/src/gprs/gprs_sgsn.c | |
| parent | e27ab916d6bcbc4f6d5dd2725f37f39c76d7ce30 (diff) | |
gbproxy/sgsn: Enforce termination when creating a P-TMSI/TLLI
Currently the number of iterations when creating a P-TMSI/TLLI is not
limited. It is nevertheless very unlikely that the loop will not
terminate. On the other hand, the number of iterations of every loop
should have an upper bound (loop variant) which wouldn't be the case
here if an arbitrary random generator was used.
This patch limits the number of iterations to 23 and logs an error if
the creation of the indentifier was aborted due to this limit.
Sponsored-by: On-Waves ehf
Diffstat (limited to 'openbsc/src/gprs/gprs_sgsn.c')
| -rw-r--r-- | openbsc/src/gprs/gprs_sgsn.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/openbsc/src/gprs/gprs_sgsn.c b/openbsc/src/gprs/gprs_sgsn.c index 0c15619b5..4e5163200 100644 --- a/openbsc/src/gprs/gprs_sgsn.c +++ b/openbsc/src/gprs/gprs_sgsn.c @@ -359,15 +359,23 @@ uint32_t sgsn_alloc_ptmsi(void) { struct sgsn_mm_ctx *mm; uint32_t ptmsi; + int max_retries = 23; restart: ptmsi = rand() | 0xC0000000; llist_for_each_entry(mm, &sgsn_mm_ctxts, list) { - if (mm->p_tmsi == ptmsi) + if (mm->p_tmsi == ptmsi) { + if (!max_retries--) + goto failed; goto restart; + } } return ptmsi; + +failed: + LOGP(DGPRS, LOGL_ERROR, "Failed to allocate a P-TMSI\n"); + return GSM_RESERVED_TMSI; } static void drop_one_pdp(struct sgsn_pdp_ctx *pdp) |