diff options
| author | Philipp Maier <pmaier@sysmocom.de> | 2017-12-04 11:42:32 +0100 |
|---|---|---|
| committer | Philipp Maier <pmaier@sysmocom.de> | 2017-12-20 11:48:18 +0100 |
| commit | 75f2c8d47fe15fd12e96351d2c836917ff659c39 (patch) | |
| tree | e17852c1a7a35ccd4fb6ab481e2d52b8c30d2af7 | |
| parent | 472275c30195040312ded0c9dcbe06d1941e556b (diff) | |
mgcp: cancel transactions on timeout
when a transaction to the MGW times out, then the context
information is freed. Unfortunately the client is not informed
about this and will try to execute the callback anyway.
explicitly cancel the transaction in order to prevent access
to already freed data structures.
Change-Id: I40794dff7d10e2b6a96863a2da7e9fbd5662a1bf
| -rw-r--r-- | include/osmocom/bsc/osmo_bsc_mgcp.h | 2 | ||||
| -rw-r--r-- | src/osmo-bsc/osmo_bsc_mgcp.c | 9 |
2 files changed, 11 insertions, 0 deletions
diff --git a/include/osmocom/bsc/osmo_bsc_mgcp.h b/include/osmocom/bsc/osmo_bsc_mgcp.h index e4b038cd9..7452513e1 100644 --- a/include/osmocom/bsc/osmo_bsc_mgcp.h +++ b/include/osmocom/bsc/osmo_bsc_mgcp.h @@ -21,6 +21,7 @@ #pragma once #include <osmocom/mgcp_client/mgcp_common.h> +#include <osmocom/mgcp_client/mgcp_client.h> /* MGCP state handler context. This context information stores all information * to handle the direction of the RTP streams via MGCP. There is one instance @@ -48,6 +49,7 @@ struct mgcp_ctx { struct gsm_lchan *lchan; struct gsm_lchan *ho_lchan; struct msgb *resp; + mgcp_trans_id_t mgw_pending_trans; }; struct mgcp_ctx *mgcp_assignm_req(void *ctx, struct mgcp_client *mgcp, struct osmo_bsc_sccp_con *conn, diff --git a/src/osmo-bsc/osmo_bsc_mgcp.c b/src/osmo-bsc/osmo_bsc_mgcp.c index ebd13d6dc..6907d4f8c 100644 --- a/src/osmo-bsc/osmo_bsc_mgcp.c +++ b/src/osmo-bsc/osmo_bsc_mgcp.c @@ -182,6 +182,7 @@ static void fsm_crcx_bts_cb(struct osmo_fsm_inst *fi, uint32_t event, void *data OSMO_ASSERT(msg); /* Transmit MGCP message to MGW */ + mgcp_ctx->mgw_pending_trans = mgcp_msg_trans_id(msg); rc = mgcp_client_tx(mgcp, msg, crcx_for_bts_resp_cb, mgcp_ctx); if (rc < 0) { handle_error(mgcp_ctx, MGCP_ERR_MGW_TX_FAIL); @@ -335,6 +336,7 @@ static void fsm_mdcx_bts_cb(struct osmo_fsm_inst *fi, uint32_t event, void *data OSMO_ASSERT(msg); /* Transmit MGCP message to MGW */ + mgcp_ctx->mgw_pending_trans = mgcp_msg_trans_id(msg); rc = mgcp_client_tx(mgcp, msg, mdcx_for_bts_resp_cb, mgcp_ctx); if (rc < 0) { handle_error(mgcp_ctx, MGCP_ERR_MGW_TX_FAIL); @@ -460,6 +462,7 @@ static void fsm_crcx_net_cb(struct osmo_fsm_inst *fi, uint32_t event, void *data OSMO_ASSERT(msg); /* Transmit MGCP message to MGW */ + mgcp_ctx->mgw_pending_trans = mgcp_msg_trans_id(msg); rc = mgcp_client_tx(mgcp, msg, crcx_for_net_resp_cb, mgcp_ctx); if (rc < 0) { handle_error(mgcp_ctx, MGCP_ERR_MGW_TX_FAIL); @@ -595,6 +598,7 @@ static void handle_teardown(struct mgcp_ctx *mgcp_ctx) OSMO_ASSERT(msg); /* Transmit MGCP message to MGW */ + mgcp_ctx->mgw_pending_trans = mgcp_msg_trans_id(msg); rc = mgcp_client_tx(mgcp, msg, dlcx_for_all_resp_cb, mgcp_ctx); if (rc < 0) { handle_error(mgcp_ctx, MGCP_ERR_MGW_TX_FAIL); @@ -652,6 +656,8 @@ static void handle_handover(struct mgcp_ctx *mgcp_ctx) msg = mgcp_msg_gen(mgcp, &mgcp_msg); OSMO_ASSERT(msg); + /* Transmit MGCP message to MGW */ + mgcp_ctx->mgw_pending_trans = mgcp_msg_trans_id(msg); rc = mgcp_client_tx(mgcp, msg, mdcx_for_bts_ho_resp_cb, mgcp_ctx); if (rc < 0) { handle_error(mgcp_ctx, MGCP_ERR_MGW_TX_FAIL); @@ -815,6 +821,9 @@ static int fsm_timeout_cb(struct osmo_fsm_inst *fi) /* At least release the occupied endpoint ID */ mgcp_client_release_endpoint(mgcp_ctx->rtp_endpoint, mgcp); + /* Cancel the transaction that timed out */ + mgcp_client_cancel(mgcp, mgcp_ctx->mgw_pending_trans); + /* Initiate self destruction of the FSM */ osmo_fsm_inst_state_chg(fi, ST_HALT, 0, 0); osmo_fsm_inst_dispatch(fi, EV_TEARDOWN, mgcp_ctx); |