Actions
Bug #5195
closedns2: Removing a bind that's in use fails with ASSERT()
Start date:
07/06/2021
Due date:
% Done:
100%
Spec Reference:
Description
telnet localhost 4246 Trying ::1... Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Welcome to the OsmoGbProxy VTY interface Copyright (C) 2010 Harald Welte and On-Waves License AGPLv3+: GNU AGPL version 3 or later <http://gnu.org/licenses/agpl-3.0.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. OsmoGbProxy> enable OsmoGbProxy# configure terminal OsmoGbProxy(config)# ns OsmoGbProxy(config-ns)# bind fr hdlc3 OsmoGbProxy(config-ns-bind)# fr hdlc3 frnet OsmoGbProxy(config-ns-bind)# OsmoGbProxy(config-ns)# nse 300 OsmoGbProxy(config-ns-nse)# nsvc fr hdlc3 dlci 302 nsvci 302 OsmoGbProxy(config-ns-nse)# OsmoGbProxy(config-ns)# no bind hdlc3 Connection closed by foreign host.
Jul 06 12:44:44 gbproxy-b osmo-gbproxy[16187]: Assert failed llist_empty(&bind->nsvc) gprs_ns2_fr.c:172
I'd expect the command to just fail if the bind is still in use
Updated by daniel almost 3 years ago
Doing the same with an SNS bind crashes instead (using the ttcn3 gbproxy test config):
OsmoGbProxy(config-ns)# no bind sgsn-side OsmoGbProxy(config-ns)# Connection closed by foreign host.
Tue Jul 6 10:47:55 2021 DLNS fsm.c:322 GPRS-NS2-SNS-BSS(NSE00101-SNS)[0x612000001a20]{BSS_SIZE}: Timeout of T1
Tue Jul 6 10:47:55 2021 DLNS gprs_ns2_sns.c:1430 GPRS-NS2-SNS-BSS(NSE00101-SNS)[0x612000001a20]{BSS_SIZE}: NSE 101: Size retries failed. Selecting next IP-SNS endpoint.
Tue Jul 6 10:47:55 2021 DLNS gprs_ns2_sns.c:1431 GPRS-NS2-SNS-BSS(NSE00101-SNS)[0x612000001a20]{BSS_SIZE}: Received Event REQ_SELECT_ENDPOINT
=================================================================
==3130577==ERROR: AddressSanitizer: heap-use-after-free on address 0x6120000018d0 at pc 0x7fe5bc25c85c bp 0x7fff339a3a00 sp 0x7fff339a39f8
READ of size 2 at 0x6120000018d0 thread T0
#0 0x7fe5bc25c85b in osmo_sockaddr_str_from_sockaddr /home/daniel/scm/osmo/libosmocore/src/sockaddr_str.c:359
#1 0x7fe5bc73b10c in gprs_ns2_ll_str_buf /home/daniel/scm/osmo/libosmocore/src/gb/gprs_ns2.c:263
#2 0x7fe5bc742cac in ns2_prim_status_ind /home/daniel/scm/osmo/libosmocore/src/gb/gprs_ns2.c:564
#3 0x7fe5bc743dfe in gprs_ns2_free_nsvc /home/daniel/scm/osmo/libosmocore/src/gb/gprs_ns2.c:639
#4 0x7fe5bc744534 in gprs_ns2_free_nsvcs /home/daniel/scm/osmo/libosmocore/src/gb/gprs_ns2.c:672
#5 0x7fe5bc76f3d5 in ns2_sns_st_all_action_bss /home/daniel/scm/osmo/libosmocore/src/gb/gprs_ns2_sns.c:1583
#6 0x7fe5bc20d574 in _osmo_fsm_inst_dispatch /home/daniel/scm/osmo/libosmocore/src/fsm.c:865
#7 0x7fe5bc7654b5 in ns2_sns_fsm_bss_timer_cb /home/daniel/scm/osmo/libosmocore/src/gb/gprs_ns2_sns.c:1431
#8 0x7fe5bc2115e9 in fsm_tmr_cb /home/daniel/scm/osmo/libosmocore/src/fsm.c:325
#9 0x7fe5bc1f1170 in osmo_timers_update /home/daniel/scm/osmo/libosmocore/src/timer.c:273
#10 0x7fe5bc1f4a6f in _osmo_select_main /home/daniel/scm/osmo/libosmocore/src/select.c:388
#11 0x7fe5bc1f4ad4 in osmo_select_main /home/daniel/scm/osmo/libosmocore/src/select.c:432
#12 0x55dceb7c3363 in main /home/daniel/scm/osmo/osmo-gbproxy/src/gb_proxy_main.c:362
#13 0x7fe5bb5dcd09 in __libc_start_main ../csu/libc-start.c:308
#14 0x55dceb7aca39 in _start (/home/daniel/scm/osmo/osmo-gbproxy/src/osmo-gbproxy+0x46a39)
0x6120000018d0 is located 144 bytes inside of 280-byte region [0x612000001840,0x612000001958)
freed by thread T0 here:
#0 0x7fe5bd317b6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123
#1 0x7fe5bca0a78a (/usr/lib/x86_64-linux-gnu/libtalloc.so.2+0x478a)
previously allocated by thread T0 here:
#0 0x7fe5bd317e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7fe5bca0cecb (/usr/lib/x86_64-linux-gnu/libtalloc.so.2+0x6ecb)
SUMMARY: AddressSanitizer: heap-use-after-free /home/daniel/scm/osmo/libosmocore/src/sockaddr_str.c:359 in osmo_sockaddr_str_from_sockaddr
Shadow bytes around the buggy address:
0x0c247fff82c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa
0x0c247fff82d0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c247fff82e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c247fff82f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa
0x0c247fff8300: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c247fff8310: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd
0x0c247fff8320: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x0c247fff8330: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c247fff8340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c247fff8350: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa
0x0c247fff8360: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==3130577==ABORTING
Updated by lynxis almost 3 years ago
- Status changed from New to Feedback
- % Done changed from 0 to 90
Updated by lynxis almost 3 years ago
- Status changed from Feedback to Closed
- % Done changed from 90 to 100
Actions
