diff options
| author | Harald Welte <laforge@osmocom.org> | 2021-11-25 13:52:18 +0100 |
|---|---|---|
| committer | pespin <pespin@sysmocom.de> | 2021-11-25 13:15:30 +0000 |
| commit | 127c419d088fe593791bc43639265c6c539335c5 (patch) | |
| tree | f89b0527ed3806066e4bf677ea8480d6ec7383ae | |
| parent | cf12cee46cae64859f43b8e78002a1654cb901cd (diff) | |
[lc15,oc2g,octphy] Fix memory leak on write queue overflow
Callers of osmo_wqueue_enqueue must always check the return value
and free the message themselves in the error case.
Change-Id: Ic67fbef23e419c0c8a7bcfb16d134e1bf649de72
Related: OS#5329
| -rw-r--r-- | src/osmo-bts-lc15/l1_if.c | 7 | ||||
| -rw-r--r-- | src/osmo-bts-oc2g/l1_if.c | 6 | ||||
| -rw-r--r-- | src/osmo-bts-octphy/l1_if.c | 6 |
3 files changed, 16 insertions, 3 deletions
diff --git a/src/osmo-bts-lc15/l1_if.c b/src/osmo-bts-lc15/l1_if.c index 02c8646e..ac165b88 100644 --- a/src/osmo-bts-lc15/l1_if.c +++ b/src/osmo-bts-lc15/l1_if.c @@ -553,7 +553,12 @@ static int ph_tch_req(struct gsm_bts_trx *trx, struct msgb *msg, empty_req_from_l1sap(l1p, fl1, u8Tn, u32Fn, sapi, subCh, u8BlockNbr); } /* send message to DSP's queue */ - osmo_wqueue_enqueue(&fl1->write_q[MQ_L1_WRITE], nmsg); + if (osmo_wqueue_enqueue(&fl1->write_q[MQ_L1_WRITE], nmsg) < 0) { + LOGPFN(DL1P, LOGL_ERROR, u32Fn, "MQ_L1_WRITE queue full. Dropping msg.\n"); + msgb_free(nmsg); + return -ENOBUFS; + } + if (dtx_is_first_p1(lchan)) dtx_dispatch(lchan, E_FIRST); else diff --git a/src/osmo-bts-oc2g/l1_if.c b/src/osmo-bts-oc2g/l1_if.c index 2cefc3b0..194f82a4 100644 --- a/src/osmo-bts-oc2g/l1_if.c +++ b/src/osmo-bts-oc2g/l1_if.c @@ -606,7 +606,11 @@ static int ph_tch_req(struct gsm_bts_trx *trx, struct msgb *msg, empty_req_from_l1sap(l1p, fl1, u8Tn, u32Fn, sapi, subCh, u8BlockNbr); } /* send message to DSP's queue */ - osmo_wqueue_enqueue(&fl1->write_q[MQ_L1_WRITE], nmsg); + if (osmo_wqueue_enqueue(&fl1->write_q[MQ_L1_WRITE], nmsg) < 0) { + LOGPFN(DL1P, LOGL_ERROR, u32Fn, "MQ_L1_WRITE queue full. Dropping msg.\n"); + msgb_free(nmsg); + return -ENOBUFS; + } if (dtx_is_first_p1(lchan)) dtx_dispatch(lchan, E_FIRST); else diff --git a/src/osmo-bts-octphy/l1_if.c b/src/osmo-bts-octphy/l1_if.c index 294a65ec..ebd960e3 100644 --- a/src/osmo-bts-octphy/l1_if.c +++ b/src/osmo-bts-octphy/l1_if.c @@ -1302,7 +1302,11 @@ static int retransmit_wlc_upto(struct octphy_hdl *fl1h, uint32_t trans_id) wlc->num_retrans++; msg = msgb_copy(wlc->cmd_msg, "PHY CMD Retrans"); msg_set_retrans_flag(msg); - osmo_wqueue_enqueue(&fl1h->phy_wq, msg); + if (osmo_wqueue_enqueue(&fl1h->phy_wq, msg) < 0) { + LOGP(DL1C, LOGL_ERROR, "Queue full on wlc retransmit\n"); + msgb_free(msg); + return 0; + } osmo_timer_schedule(&wlc->timer, CMD_TIMEOUT, 0); count++; LOGP(DL1C, LOGL_INFO, "Re-transmitting %s " |