Project

General

Profile

Actions
Copy link

Bug #3824

closed

transactions like SMS may trigger while a RAN connection is already in release and cause a heap-use-after-free

Added by neels about 5 years ago. Updated about 5 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
neels
Category:
-
Target version:
-
Start date:
03/07/2019
Due date:
% Done:

100%

Resolution:
Spec Reference:

Description

In current osmo-msc master, when a RAN conn goes into release, it first off cleans up its transactions.
It then sends a Clear Command and continues to exist until a Clear Complete -- or a timeout.
If during this time e.g. a periodic SMS queue calls connection_for_subscr(), this connection will actually be returned and used.
The result is that a new transaction is added to a connection that is already in release.
Upon the final Clear Complete or timeout, the conn then deallocates, assuming that its list of transactions is still empty.
If then the transaction fires some async action, like a timeout, the access to its conn pointer becomes a use-after-free.

A log transcript follows.

Actions
Copy link

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)