diff options
| author | Harald Welte <laforge@osmocom.org> | 2020-07-04 10:52:13 +0200 |
|---|---|---|
| committer | Harald Welte <laforge@osmocom.org> | 2020-07-04 10:52:13 +0200 |
| commit | bc1d7152c1fa8050b4d5a93c5ef03eb017e1a444 (patch) | |
| tree | 97114160bb24634e0acd8ca13c1293686f6e3b70 | |
| parent | 8617d09ee375c66b3aa2f6fe26c5b744b156c740 (diff) | |
lapd_core: After calling into L3, check if the state has changed
While processing an I-frame we may deliver its payload to L3. After
returning from L3 procesing, we run some additional code, assuming
the LAPD/DL state has not changed meanwhile.
However, if the application destroys the LAPD/DL meanwhile, our state
might be NULL again, and in this state we should not perform any further
action.
This is one of the cases where synchronous in-line dispatch across
various layers is hitting us. L3 should have an input queue, and only
start processing after all L2 work has completed and we're about to go
back to sleep in select().
Change-Id: I026b64503511002c13c0f4117648c366c48ecc62
Related: OS#1761
Closes: OS#4646
| -rw-r--r-- | src/gsm/lapd_core.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/gsm/lapd_core.c b/src/gsm/lapd_core.c index cf25f3de..6a56572b 100644 --- a/src/gsm/lapd_core.c +++ b/src/gsm/lapd_core.c @@ -1578,6 +1578,10 @@ static int lapd_rx_i(struct msgb *msg, struct lapd_msg_ctx *lctx) msgb_free(msg); } + /* the L3 or higher (called in-line above via send_dl_l3) might have destroyed the + * data link meanwhile. See OS#1761 */ + if (dl->state == LAPD_STATE_NULL) + return 0; } else LOGDL(dl, LOGL_INFO, "I frame ignored during own receiver busy condition\n"); |