fix: properly cancel all Paging on IMSI Detach

It's not clear cut which code is responsible for canceling pending requests,
since the requests list is kept in vlr_subscr, but sending out Paging does
certainly not belong in the VLR. Place the requests cleanup in gsm_04_08.c.

Add to test_ms_timeout_paging() in msc_vlr_test_ms_timeout.c to verify that a
pending paging is canceled on IMSI Detach.

Change-Id: Ib8874a9d92f02b0826525b55518332f6899688fd

5 files changed, 43 insertions, 5 deletions

diff --git a/include/osmocom/msc/gsm_subscriber.h b/include/osmocom/msc/gsm_subscriber.h
index 6b0e3da42..4adfd41b6 100644
--- a/include/osmocom/msc/gsm_subscriber.h
+++ b/include/osmocom/msc/gsm_subscriber.h
@@ -62,6 +62,7 @@ void subscr_remove_request(struct subscr_request *req);
 int subscr_rx_paging_response(struct msgb *msg,
 			      struct gsm_subscriber_connection *conn);
 
+void subscr_paging_cancel(struct vlr_subscr *vsub, enum gsm_paging_event event);
 int subscr_paging_dispatch(unsigned int hooknum, unsigned int event,
 			   struct msgb *msg, void *data, void *param);
 
diff --git a/src/libmsc/gsm_04_08.c b/src/libmsc/gsm_04_08.c
index e370962ea..26ac92319 100644
--- a/src/libmsc/gsm_04_08.c
+++ b/src/libmsc/gsm_04_08.c
@@ -770,6 +770,10 @@ static int gsm48_rx_mm_imsi_detach_ind(struct gsm_subscriber_connection *conn, s
 		     gsm48_mi_type_name(mi_type), mi_string);
 	} else {
 		LOGP(DMM, LOGL_INFO, "IMSI DETACH for %s\n", vlr_subscr_name(vsub));
+
+		if (vsub->cs.is_paging)
+			subscr_paging_cancel(vsub, GSM_PAGING_EXPIRED);
+
 		vlr_subscr_rx_imsi_detach(vsub);
 		osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_DETACHED, vsub);
 		vlr_subscr_put(vsub);
diff --git a/src/libmsc/gsm_subscriber.c b/src/libmsc/gsm_subscriber.c
index b3d38d1e8..1a7bf592c 100644
--- a/src/libmsc/gsm_subscriber.c
+++ b/src/libmsc/gsm_subscriber.c
@@ -52,6 +52,11 @@
 #include <osmocom/msc/msc_ifaces.h>
 #include <osmocom/msc/a_iface.h>
 
+void subscr_paging_cancel(struct vlr_subscr *vsub, enum gsm_paging_event event)
+{
+	subscr_paging_dispatch(GSM_HOOK_RR_PAGING, event, NULL, NULL, vsub);
+}
+
 int subscr_paging_dispatch(unsigned int hooknum, unsigned int event,
 			   struct msgb *msg, void *data, void *param)
 {
@@ -132,7 +137,7 @@ int msc_paging_request(struct vlr_subscr *vsub)
 static void paging_response_timer_cb(void *data)
 {
 	struct vlr_subscr *vsub = data;
-	subscr_paging_dispatch(GSM_HOOK_RR_PAGING, GSM_PAGING_EXPIRED, NULL, NULL, vsub);
+	subscr_paging_cancel(vsub, GSM_PAGING_EXPIRED);
 }
 
 /*! \brief Start a paging request for vsub, call cbfn(param) when done.
diff --git a/tests/msc_vlr/msc_vlr_test_ms_timeout.c b/tests/msc_vlr/msc_vlr_test_ms_timeout.c
index 4e0e27d1d..4cfd03513 100644
--- a/tests/msc_vlr/msc_vlr_test_ms_timeout.c
+++ b/tests/msc_vlr/msc_vlr_test_ms_timeout.c
@@ -258,13 +258,26 @@ void test_ms_timeout_paging()
 	OSMO_ASSERT(vsub);
 	VERBOSE_ASSERT(vsub->cs.is_paging, == false, "%d");
 	VERBOSE_ASSERT(llist_count(&vsub->cs.requests), == 0, "%d");
+
+	BTW("Now that the timeout has expired, another Paging is sent on request");
+	paging_expect_imsi(imsi);
+	paging_sent = false;
+
+	send_sms(vsub, vsub,
+		 "Privacy in residential applications is a desirable"
+		 " marketing option.");
+
+	VERBOSE_ASSERT(llist_count(&vsub->cs.requests), == 1, "%d");
 	vlr_subscr_put(vsub);
 	vsub = NULL;
+	VERBOSE_ASSERT(paging_sent, == true, "%d");
+	VERBOSE_ASSERT(paging_stopped, == false, "%d");
 
-	BTW("subscriber detaches");
+	BTW("subscriber detaches, pagings are canceled");
 	expect_bssap_clear();
 	ms_sends_msg("050130089910070000006402");
 	VERBOSE_ASSERT(bssap_clear_sent, == true, "%d");
+	VERBOSE_ASSERT(paging_stopped, == true, "%d");
 
 	vsub = vlr_subscr_find_by_imsi(net->vlr, imsi);
 	OSMO_ASSERT(!vsub);
diff --git a/tests/msc_vlr/msc_vlr_test_ms_timeout.err b/tests/msc_vlr/msc_vlr_test_ms_timeout.err
index c8b7e962e..f0c4116ef 100644
--- a/tests/msc_vlr/msc_vlr_test_ms_timeout.err
+++ b/tests/msc_vlr/msc_vlr_test_ms_timeout.err
@@ -480,16 +480,30 @@ DREF VLR subscr MSISDN:46071 usage decreases to: 1
 DREF VLR subscr MSISDN:46071 usage increases to: 2
   vsub->cs.is_paging == 0
   llist_count(&vsub->cs.requests) == 0
-DREF VLR subscr MSISDN:46071 usage decreases to: 1
 ---
-- subscriber detaches
+- Now that the timeout has expired, another Paging is sent on request
+DREF VLR subscr MSISDN:46071 usage increases to: 3
+DMM Subscriber MSISDN:46071 not paged yet, start paging.
+  RAN_GERAN_A sends out paging request to IMSI 901700000004620, TMSI 0xffffffff, LAC 23
+  strcmp(paging_expecting_imsi, imsi) == 0
+DREF VLR subscr MSISDN:46071 usage increases to: 4
+  llist_count(&vsub->cs.requests) == 1
+DREF VLR subscr MSISDN:46071 usage decreases to: 3
+  paging_sent == 1
+  paging_stopped == 0
+---
+- subscriber detaches, pagings are canceled
   MSC <--RAN_GERAN_A-- MS: GSM48_MT_MM_IMSI_DETACH_IND
   new conn
 DREF unknown: MSC conn use + compl_l3 == 1 (0x1)
 DRLL Dispatching 04.08 message GSM48_MT_MM_IMSI_DETACH_IND (0x5:0x1)
 DMM IMSI DETACH INDICATION: MI(IMSI)=901700000004620
-DREF VLR subscr MSISDN:46071 usage increases to: 2
+DREF VLR subscr MSISDN:46071 usage increases to: 4
 DMM IMSI DETACH for MSISDN:46071
+DPAG Paging failure for MSISDN:46071 (event=1)
+DPAG Calling paging cbfn.
+DREF VLR subscr MSISDN:46071 usage decreases to: 3
+DREF VLR subscr MSISDN:46071 usage decreases to: 2
 DREF VLR subscr MSISDN:46071 usage decreases to: 1
 DREF VLR subscr MSISDN:46071 usage decreases to: 0
 DREF freeing VLR subscr MSISDN:46071
@@ -498,6 +512,7 @@ DMM msc_subscr_conn_close(vsub=unknown, cause=0): no conn fsm, releasing directl
 DREF unknown: MSC conn use - compl_l3 == 0 (0x0)
 DRLL Freeing subscriber connection with NULL subscriber
   bssap_clear_sent == 1
+  paging_stopped == 1
   llist_count(&net->subscr_conns) == 0
 ===== test_ms_timeout_paging: SUCCESS