diff options
| author | Vadim Yanitskiy <vyanitskiy@sysmocom.de> | 2023-09-16 06:44:56 +0700 |
|---|---|---|
| committer | fixeria <vyanitskiy@sysmocom.de> | 2023-09-28 14:43:22 +0000 |
| commit | aa06f9732672098eb58cb11ec388f3ea932fbd5b (patch) | |
| tree | 699e0ce384113028d7158a39477f898cce62e1f1 | |
| parent | 188f76275a2b0d64a4b1beaceb73ad89c837a607 (diff) | |
l1sap: l1sap_tch_ind(): fix segfault on stale TCH.ind
It was reported that osmo-bts-sysmo is crashing due to a TCH.ind
primitive being received by l1sap_tch_ind() for an lchan, which
is operating neither in speech nor data, but in signalling mode.
It's not clear which scenario is causing this situation. My best
guess is that one or more TCH.ind primitive(s) remain waiting in
the lower layers and bob up right after the channel mode change.
This can happen, for instance, when a dynamic timeslot gets
switched from TCH/F or TCH/H to PDCH or SDCCH/8.
Change-Id: I2d270ab654fdd9d19d1708ff6c4b4e902bd5d0a3
Fixes: d1f8f3429 "l1sap: proper rate adaptation for CSD"
Closes: OS#6180
| -rw-r--r-- | src/common/l1sap.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/common/l1sap.c b/src/common/l1sap.c index b8283077..844fdada 100644 --- a/src/common/l1sap.c +++ b/src/common/l1sap.c @@ -1990,6 +1990,7 @@ static int l1sap_tch_ind(struct gsm_bts_trx *trx, struct osmo_phsap_prim *l1sap, send_ul_rtp_packet_data(lchan, fn, msg->data, msg->len); break; case RSL_CMOD_SPD_SIGN: + return 0; /* drop stale TCH.ind */ default: /* shall not happen */ OSMO_ASSERT(0); } |