diff options
author | Neels Hofmeyr <neels@hofmeyr.de> | 2020-08-19 13:40:33 +0000 |
---|---|---|
committer | laforge <laforge@osmocom.org> | 2020-08-24 07:34:27 +0000 |
commit | 667d5e0b95d01946ba5e80ae7e202576c05cc5c1 (patch) | |
tree | f9a6eadb1dcdb3848b3706978128eb81dbb9746f | |
parent | 24a885608d5ffe5861b6a467d48f2e0ebd3f23a7 (diff) |
fix crash for unknown MI during Paging Response
Related: OS#4724
Related: I40496bbccbbd9c496cfa57df49e26f124a2b1554 (osmo-ttcn3-hacks)
Change-Id: Ia2c8fa745cfab17ed7114d433f625ddc02ae7b11
-rw-r--r-- | src/libmsc/gsm_04_08.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/libmsc/gsm_04_08.c b/src/libmsc/gsm_04_08.c index 15303b599..6bd82d0e1 100644 --- a/src/libmsc/gsm_04_08.c +++ b/src/libmsc/gsm_04_08.c @@ -1185,7 +1185,12 @@ static int gsm48_rx_rr_pag_resp(struct msc_a *msc_a, struct msgb *msg) vsub = msc_a_vsub(msc_a); if (!vsub) { LOG_MSC_A_CAT(msc_a, DRR, LOGL_ERROR, "subscriber not allowed to do a Paging Response\n"); - msc_a_put(msc_a, MSC_A_USE_PAGING_RESPONSE); + + /* Above MSC_A_USE_PAGING_RESPONSE may already have been removed by a forced release, put that use only + * if it still exists. (see msc_a_fsm_releasing_onenter()) */ + if (osmo_use_count_by(&msc_a->use_count, MSC_A_USE_PAGING_RESPONSE)) + msc_a_put(msc_a, MSC_A_USE_PAGING_RESPONSE); + return -EIO; } |