Fix heap-use-after-free due to OML link destruction

Back-port from osmo-bsc.git 9862bcb5cdb9ece0acfdfb7c81e00c05fcd33ad3.

ipaccess_drop_oml was being called inside an osmo_fd cb context, were
-EBADF must be returned if the structure holding the osmo_fd is freed.
In the middle of the path (see OS#3495 for path tree) it goes through a
signal dispatch, so it's impossible to make sure we return some value to
the osmo_fd cb. As a result, it is required to defer dropping the OML
Link from current code path and do it through a timer.

Fixes following ASan report:
20180822124927913  <0004> abis_nm.c:787 OC=RADIO-CARRIER(02) INST=(00,00,ff): CHANGE ADMINISTRATIVE STATE NACK CAUSE=Message cannot be performed
20180822124927913  <0004> osmo_bsc_main.c:186 Got CHANGE ADMINISTRATIVE STATE NACK going to drop the OML links.
20180822124927913  <0015> bts_ipaccess_nanobts.c:406 (bts=0) Dropping OML link.
...
=================================================================
==17607==ERROR: AddressSanitizer: heap-use-after-free on address 0x62e000060a68 at pc 0x7f5ea8e27086 bp 0x7ffde92b6d80 sp 0x7ffde92b6d78
READ of size 8 at 0x62e000060a68 thread T0
	#0 0x7f5ea8e27085 in handle_ts1_write input/ipaccess.c:371
	#1 0x7f5ea8e27085 in ipaccess_fd_cb input/ipaccess.c:391
	#2 0x7f5ea9147ca8 in osmo_fd_disp_fds libosmocore/src/select.c:217
	#3 0x7f5ea9147ca8 in osmo_select_main libosmocore/src/select.c:257
	#4 0x555813ab79d6 in main osmo-bsc/osmo_bsc_main.c:922
	#5 0x7f5ea76d02e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
	#6 0x555813ab84e9 in _start (/bin/osmo-bsc+0x34d4e9)

Fixes: OS#3495
Change-Id: If9e73a3251547625a2372d58f1d8b87210d9f312

4 files changed, 31 insertions, 2 deletions

diff --git a/openbsc/include/openbsc/gsm_data_shared.h b/openbsc/include/openbsc/gsm_data_shared.h
index ddd59918e..e616c1260 100644
--- a/openbsc/include/openbsc/gsm_data_shared.h
+++ b/openbsc/include/openbsc/gsm_data_shared.h
@@ -723,6 +723,8 @@ struct gsm_bts {
 	struct gsm_e1_subslot oml_e1_link;
 	uint8_t oml_tei;
 	struct e1inp_sign_link *oml_link;
+	/* Timer to use for deferred drop of OML link, see \ref ipaccess_drop_oml_deferred */
+	struct osmo_timer_list oml_drop_link_timer;
 	/* when OML link was established */
 	time_t uptime;
 
diff --git a/openbsc/include/openbsc/ipaccess.h b/openbsc/include/openbsc/ipaccess.h
index 82e89c27d..1b5a48561 100644
--- a/openbsc/include/openbsc/ipaccess.h
+++ b/openbsc/include/openbsc/ipaccess.h
@@ -29,6 +29,7 @@ struct ipac_ext_lac_cmd {
 } __attribute__((packed));
 
 void ipaccess_drop_oml(struct gsm_bts *bts);
+void ipaccess_drop_oml_deferred(struct gsm_bts *bts);
 void ipaccess_drop_rsl(struct gsm_bts_trx *trx);
 
 struct sdp_header_item {
diff --git a/openbsc/src/libbsc/bsc_init.c b/openbsc/src/libbsc/bsc_init.c
index 21ed2e1cf..218b02a9e 100644
--- a/openbsc/src/libbsc/bsc_init.c
+++ b/openbsc/src/libbsc/bsc_init.c
@@ -65,7 +65,7 @@ static int oml_msg_nack(struct nm_nack_signal_data *nack)
 	}
 
 	if (is_ipaccess_bts(nack->bts))
-		ipaccess_drop_oml(nack->bts);
+		ipaccess_drop_oml_deferred(nack->bts);
 
 	return 0;
 }
diff --git a/openbsc/src/libbsc/bts_ipaccess_nanobts.c b/openbsc/src/libbsc/bts_ipaccess_nanobts.c
index 64eb4f24a..ea8376744 100644
--- a/openbsc/src/libbsc/bts_ipaccess_nanobts.c
+++ b/openbsc/src/libbsc/bts_ipaccess_nanobts.c
@@ -157,7 +157,7 @@ static int nm_statechg_event(int evt, struct nm_statechg_signal_data *nsd)
 			enum abis_nm_chan_comb ccomb =
 						abis_nm_chcomb4pchan(ts->pchan);
 			if (abis_nm_set_channel_attr(ts, ccomb) == -EINVAL) {
-				ipaccess_drop_oml(trx->bts);
+				ipaccess_drop_oml_deferred(trx->bts);
 				return -1;
 			}
 			abis_nm_chg_adm_state(trx->bts, obj_class,
@@ -360,6 +360,9 @@ void ipaccess_drop_oml(struct gsm_bts *bts)
 	struct gsm_bts *rdep_bts;
 	struct gsm_bts_trx *trx;
 
+	/* First of all, remove deferred drop if enabled */
+	osmo_timer_del(&bts->oml_drop_link_timer);
+
 	if (!bts->oml_link)
 		return;
 
@@ -389,6 +392,29 @@ void ipaccess_drop_oml(struct gsm_bts *bts)
 	}
 }
 
+/*! Callback for  \ref ipaccess_drop_oml_deferred_cb.
+ */
+static void ipaccess_drop_oml_deferred_cb(void *data)
+{
+	struct gsm_bts *bts = (struct gsm_bts *) data;
+	ipaccess_drop_oml(bts);
+}
+/*! Deferr \ref ipacces_drop_oml through a timer to avoid dropping structures in
+ *  current code context. This may be needed if we want to destroy the OML link
+ *  while being called from a lower layer "struct osmo_fd" cb, were it is
+ *  mandatory to return -EBADF if the osmo_fd has been destroyed. In case code
+ *  destroying an OML link is called through an osmo_signal, it becomes
+ *  impossible to return any value, thus deferring the destruction is required.
+ */
+void ipaccess_drop_oml_deferred(struct gsm_bts *bts)
+{
+	if (!osmo_timer_pending(&bts->oml_drop_link_timer) && bts->oml_link) {
+		LOGP(DLINP, LOGL_NOTICE, "(bts=%d) Deferring Drop of OML link.\n", bts->nr);
+		osmo_timer_setup(&bts->oml_drop_link_timer, ipaccess_drop_oml_deferred_cb, bts);
+		osmo_timer_schedule(&bts->oml_drop_link_timer, 0, 0);
+	}
+}
+
 /* This function is called once the OML/RSL link becomes up. */
 static struct e1inp_sign_link *
 ipaccess_sign_link_up(void *unit_data, struct e1inp_line *line,