diff options
author | Pau Espin Pedrol <pespin@sysmocom.de> | 2018-08-28 19:06:06 +0200 |
---|---|---|
committer | Pau Espin Pedrol <pespin@sysmocom.de> | 2018-08-28 19:06:36 +0200 |
commit | 5ea1e9c59272a0b18bfac221051684169adee99f (patch) | |
tree | 96aa73db57737a6d8497d5a099e21cc3fcadf4a2 /openbsc | |
parent | a850cc449ff067eed376579ebcf239260266323a (diff) |
Fix heap-use-after-free due to OML link destruction
Back-port from osmo-bsc.git 9862bcb5cdb9ece0acfdfb7c81e00c05fcd33ad3.
ipaccess_drop_oml was being called inside an osmo_fd cb context, were
-EBADF must be returned if the structure holding the osmo_fd is freed.
In the middle of the path (see OS#3495 for path tree) it goes through a
signal dispatch, so it's impossible to make sure we return some value to
the osmo_fd cb. As a result, it is required to defer dropping the OML
Link from current code path and do it through a timer.
Fixes following ASan report:
20180822124927913 <0004> abis_nm.c:787 OC=RADIO-CARRIER(02) INST=(00,00,ff): CHANGE ADMINISTRATIVE STATE NACK CAUSE=Message cannot be performed
20180822124927913 <0004> osmo_bsc_main.c:186 Got CHANGE ADMINISTRATIVE STATE NACK going to drop the OML links.
20180822124927913 <0015> bts_ipaccess_nanobts.c:406 (bts=0) Dropping OML link.
...
=================================================================
==17607==ERROR: AddressSanitizer: heap-use-after-free on address 0x62e000060a68 at pc 0x7f5ea8e27086 bp 0x7ffde92b6d80 sp 0x7ffde92b6d78
READ of size 8 at 0x62e000060a68 thread T0
#0 0x7f5ea8e27085 in handle_ts1_write input/ipaccess.c:371
#1 0x7f5ea8e27085 in ipaccess_fd_cb input/ipaccess.c:391
#2 0x7f5ea9147ca8 in osmo_fd_disp_fds libosmocore/src/select.c:217
#3 0x7f5ea9147ca8 in osmo_select_main libosmocore/src/select.c:257
#4 0x555813ab79d6 in main osmo-bsc/osmo_bsc_main.c:922
#5 0x7f5ea76d02e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
#6 0x555813ab84e9 in _start (/bin/osmo-bsc+0x34d4e9)
Fixes: OS#3495
Change-Id: If9e73a3251547625a2372d58f1d8b87210d9f312
Diffstat (limited to 'openbsc')
-rw-r--r-- | openbsc/include/openbsc/gsm_data_shared.h | 2 | ||||
-rw-r--r-- | openbsc/include/openbsc/ipaccess.h | 1 | ||||
-rw-r--r-- | openbsc/src/libbsc/bsc_init.c | 2 | ||||
-rw-r--r-- | openbsc/src/libbsc/bts_ipaccess_nanobts.c | 28 |
4 files changed, 31 insertions, 2 deletions
diff --git a/openbsc/include/openbsc/gsm_data_shared.h b/openbsc/include/openbsc/gsm_data_shared.h index ddd59918e..e616c1260 100644 --- a/openbsc/include/openbsc/gsm_data_shared.h +++ b/openbsc/include/openbsc/gsm_data_shared.h @@ -723,6 +723,8 @@ struct gsm_bts { struct gsm_e1_subslot oml_e1_link; uint8_t oml_tei; struct e1inp_sign_link *oml_link; + /* Timer to use for deferred drop of OML link, see \ref ipaccess_drop_oml_deferred */ + struct osmo_timer_list oml_drop_link_timer; /* when OML link was established */ time_t uptime; diff --git a/openbsc/include/openbsc/ipaccess.h b/openbsc/include/openbsc/ipaccess.h index 82e89c27d..1b5a48561 100644 --- a/openbsc/include/openbsc/ipaccess.h +++ b/openbsc/include/openbsc/ipaccess.h @@ -29,6 +29,7 @@ struct ipac_ext_lac_cmd { } __attribute__((packed)); void ipaccess_drop_oml(struct gsm_bts *bts); +void ipaccess_drop_oml_deferred(struct gsm_bts *bts); void ipaccess_drop_rsl(struct gsm_bts_trx *trx); struct sdp_header_item { diff --git a/openbsc/src/libbsc/bsc_init.c b/openbsc/src/libbsc/bsc_init.c index 21ed2e1cf..218b02a9e 100644 --- a/openbsc/src/libbsc/bsc_init.c +++ b/openbsc/src/libbsc/bsc_init.c @@ -65,7 +65,7 @@ static int oml_msg_nack(struct nm_nack_signal_data *nack) } if (is_ipaccess_bts(nack->bts)) - ipaccess_drop_oml(nack->bts); + ipaccess_drop_oml_deferred(nack->bts); return 0; } diff --git a/openbsc/src/libbsc/bts_ipaccess_nanobts.c b/openbsc/src/libbsc/bts_ipaccess_nanobts.c index 64eb4f24a..ea8376744 100644 --- a/openbsc/src/libbsc/bts_ipaccess_nanobts.c +++ b/openbsc/src/libbsc/bts_ipaccess_nanobts.c @@ -157,7 +157,7 @@ static int nm_statechg_event(int evt, struct nm_statechg_signal_data *nsd) enum abis_nm_chan_comb ccomb = abis_nm_chcomb4pchan(ts->pchan); if (abis_nm_set_channel_attr(ts, ccomb) == -EINVAL) { - ipaccess_drop_oml(trx->bts); + ipaccess_drop_oml_deferred(trx->bts); return -1; } abis_nm_chg_adm_state(trx->bts, obj_class, @@ -360,6 +360,9 @@ void ipaccess_drop_oml(struct gsm_bts *bts) struct gsm_bts *rdep_bts; struct gsm_bts_trx *trx; + /* First of all, remove deferred drop if enabled */ + osmo_timer_del(&bts->oml_drop_link_timer); + if (!bts->oml_link) return; @@ -389,6 +392,29 @@ void ipaccess_drop_oml(struct gsm_bts *bts) } } +/*! Callback for \ref ipaccess_drop_oml_deferred_cb. + */ +static void ipaccess_drop_oml_deferred_cb(void *data) +{ + struct gsm_bts *bts = (struct gsm_bts *) data; + ipaccess_drop_oml(bts); +} +/*! Deferr \ref ipacces_drop_oml through a timer to avoid dropping structures in + * current code context. This may be needed if we want to destroy the OML link + * while being called from a lower layer "struct osmo_fd" cb, were it is + * mandatory to return -EBADF if the osmo_fd has been destroyed. In case code + * destroying an OML link is called through an osmo_signal, it becomes + * impossible to return any value, thus deferring the destruction is required. + */ +void ipaccess_drop_oml_deferred(struct gsm_bts *bts) +{ + if (!osmo_timer_pending(&bts->oml_drop_link_timer) && bts->oml_link) { + LOGP(DLINP, LOGL_NOTICE, "(bts=%d) Deferring Drop of OML link.\n", bts->nr); + osmo_timer_setup(&bts->oml_drop_link_timer, ipaccess_drop_oml_deferred_cb, bts); + osmo_timer_schedule(&bts->oml_drop_link_timer, 0, 0); + } +} + /* This function is called once the OML/RSL link becomes up. */ static struct e1inp_sign_link * ipaccess_sign_link_up(void *unit_data, struct e1inp_line *line, |