From 5ea1e9c59272a0b18bfac221051684169adee99f Mon Sep 17 00:00:00 2001 From: Pau Espin Pedrol Date: Tue, 28 Aug 2018 19:06:06 +0200 Subject: Fix heap-use-after-free due to OML link destruction Back-port from osmo-bsc.git 9862bcb5cdb9ece0acfdfb7c81e00c05fcd33ad3. ipaccess_drop_oml was being called inside an osmo_fd cb context, were -EBADF must be returned if the structure holding the osmo_fd is freed. In the middle of the path (see OS#3495 for path tree) it goes through a signal dispatch, so it's impossible to make sure we return some value to the osmo_fd cb. As a result, it is required to defer dropping the OML Link from current code path and do it through a timer. Fixes following ASan report: 20180822124927913 <0004> abis_nm.c:787 OC=RADIO-CARRIER(02) INST=(00,00,ff): CHANGE ADMINISTRATIVE STATE NACK CAUSE=Message cannot be performed 20180822124927913 <0004> osmo_bsc_main.c:186 Got CHANGE ADMINISTRATIVE STATE NACK going to drop the OML links. 20180822124927913 <0015> bts_ipaccess_nanobts.c:406 (bts=0) Dropping OML link. ... ================================================================= ==17607==ERROR: AddressSanitizer: heap-use-after-free on address 0x62e000060a68 at pc 0x7f5ea8e27086 bp 0x7ffde92b6d80 sp 0x7ffde92b6d78 READ of size 8 at 0x62e000060a68 thread T0 #0 0x7f5ea8e27085 in handle_ts1_write input/ipaccess.c:371 #1 0x7f5ea8e27085 in ipaccess_fd_cb input/ipaccess.c:391 #2 0x7f5ea9147ca8 in osmo_fd_disp_fds libosmocore/src/select.c:217 #3 0x7f5ea9147ca8 in osmo_select_main libosmocore/src/select.c:257 #4 0x555813ab79d6 in main osmo-bsc/osmo_bsc_main.c:922 #5 0x7f5ea76d02e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0) #6 0x555813ab84e9 in _start (/bin/osmo-bsc+0x34d4e9) Fixes: OS#3495 Change-Id: If9e73a3251547625a2372d58f1d8b87210d9f312 --- openbsc/include/openbsc/gsm_data_shared.h | 2 ++ openbsc/include/openbsc/ipaccess.h | 1 + openbsc/src/libbsc/bsc_init.c | 2 +- openbsc/src/libbsc/bts_ipaccess_nanobts.c | 28 +++++++++++++++++++++++++++- 4 files changed, 31 insertions(+), 2 deletions(-) (limited to 'openbsc') diff --git a/openbsc/include/openbsc/gsm_data_shared.h b/openbsc/include/openbsc/gsm_data_shared.h index ddd59918e..e616c1260 100644 --- a/openbsc/include/openbsc/gsm_data_shared.h +++ b/openbsc/include/openbsc/gsm_data_shared.h @@ -723,6 +723,8 @@ struct gsm_bts { struct gsm_e1_subslot oml_e1_link; uint8_t oml_tei; struct e1inp_sign_link *oml_link; + /* Timer to use for deferred drop of OML link, see \ref ipaccess_drop_oml_deferred */ + struct osmo_timer_list oml_drop_link_timer; /* when OML link was established */ time_t uptime; diff --git a/openbsc/include/openbsc/ipaccess.h b/openbsc/include/openbsc/ipaccess.h index 82e89c27d..1b5a48561 100644 --- a/openbsc/include/openbsc/ipaccess.h +++ b/openbsc/include/openbsc/ipaccess.h @@ -29,6 +29,7 @@ struct ipac_ext_lac_cmd { } __attribute__((packed)); void ipaccess_drop_oml(struct gsm_bts *bts); +void ipaccess_drop_oml_deferred(struct gsm_bts *bts); void ipaccess_drop_rsl(struct gsm_bts_trx *trx); struct sdp_header_item { diff --git a/openbsc/src/libbsc/bsc_init.c b/openbsc/src/libbsc/bsc_init.c index 21ed2e1cf..218b02a9e 100644 --- a/openbsc/src/libbsc/bsc_init.c +++ b/openbsc/src/libbsc/bsc_init.c @@ -65,7 +65,7 @@ static int oml_msg_nack(struct nm_nack_signal_data *nack) } if (is_ipaccess_bts(nack->bts)) - ipaccess_drop_oml(nack->bts); + ipaccess_drop_oml_deferred(nack->bts); return 0; } diff --git a/openbsc/src/libbsc/bts_ipaccess_nanobts.c b/openbsc/src/libbsc/bts_ipaccess_nanobts.c index 64eb4f24a..ea8376744 100644 --- a/openbsc/src/libbsc/bts_ipaccess_nanobts.c +++ b/openbsc/src/libbsc/bts_ipaccess_nanobts.c @@ -157,7 +157,7 @@ static int nm_statechg_event(int evt, struct nm_statechg_signal_data *nsd) enum abis_nm_chan_comb ccomb = abis_nm_chcomb4pchan(ts->pchan); if (abis_nm_set_channel_attr(ts, ccomb) == -EINVAL) { - ipaccess_drop_oml(trx->bts); + ipaccess_drop_oml_deferred(trx->bts); return -1; } abis_nm_chg_adm_state(trx->bts, obj_class, @@ -360,6 +360,9 @@ void ipaccess_drop_oml(struct gsm_bts *bts) struct gsm_bts *rdep_bts; struct gsm_bts_trx *trx; + /* First of all, remove deferred drop if enabled */ + osmo_timer_del(&bts->oml_drop_link_timer); + if (!bts->oml_link) return; @@ -389,6 +392,29 @@ void ipaccess_drop_oml(struct gsm_bts *bts) } } +/*! Callback for \ref ipaccess_drop_oml_deferred_cb. + */ +static void ipaccess_drop_oml_deferred_cb(void *data) +{ + struct gsm_bts *bts = (struct gsm_bts *) data; + ipaccess_drop_oml(bts); +} +/*! Deferr \ref ipacces_drop_oml through a timer to avoid dropping structures in + * current code context. This may be needed if we want to destroy the OML link + * while being called from a lower layer "struct osmo_fd" cb, were it is + * mandatory to return -EBADF if the osmo_fd has been destroyed. In case code + * destroying an OML link is called through an osmo_signal, it becomes + * impossible to return any value, thus deferring the destruction is required. + */ +void ipaccess_drop_oml_deferred(struct gsm_bts *bts) +{ + if (!osmo_timer_pending(&bts->oml_drop_link_timer) && bts->oml_link) { + LOGP(DLINP, LOGL_NOTICE, "(bts=%d) Deferring Drop of OML link.\n", bts->nr); + osmo_timer_setup(&bts->oml_drop_link_timer, ipaccess_drop_oml_deferred_cb, bts); + osmo_timer_schedule(&bts->oml_drop_link_timer, 0, 0); + } +} + /* This function is called once the OML/RSL link becomes up. */ static struct e1inp_sign_link * ipaccess_sign_link_up(void *unit_data, struct e1inp_line *line, -- cgit v1.2.3