Actions
Bug #5195
closedns2: Removing a bind that's in use fails with ASSERT()
Start date:
07/06/2021
Due date:
% Done:
100%
Spec Reference:
Description
telnet localhost 4246 Trying ::1... Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Welcome to the OsmoGbProxy VTY interface Copyright (C) 2010 Harald Welte and On-Waves License AGPLv3+: GNU AGPL version 3 or later <http://gnu.org/licenses/agpl-3.0.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. OsmoGbProxy> enable OsmoGbProxy# configure terminal OsmoGbProxy(config)# ns OsmoGbProxy(config-ns)# bind fr hdlc3 OsmoGbProxy(config-ns-bind)# fr hdlc3 frnet OsmoGbProxy(config-ns-bind)# OsmoGbProxy(config-ns)# nse 300 OsmoGbProxy(config-ns-nse)# nsvc fr hdlc3 dlci 302 nsvci 302 OsmoGbProxy(config-ns-nse)# OsmoGbProxy(config-ns)# no bind hdlc3 Connection closed by foreign host.
Jul 06 12:44:44 gbproxy-b osmo-gbproxy[16187]: Assert failed llist_empty(&bind->nsvc) gprs_ns2_fr.c:172
I'd expect the command to just fail if the bind is still in use
Updated by daniel almost 3 years ago
Doing the same with an SNS bind crashes instead (using the ttcn3 gbproxy test config):
OsmoGbProxy(config-ns)# no bind sgsn-side OsmoGbProxy(config-ns)# Connection closed by foreign host.
Tue Jul 6 10:47:55 2021 DLNS fsm.c:322 GPRS-NS2-SNS-BSS(NSE00101-SNS)[0x612000001a20]{BSS_SIZE}: Timeout of T1 Tue Jul 6 10:47:55 2021 DLNS gprs_ns2_sns.c:1430 GPRS-NS2-SNS-BSS(NSE00101-SNS)[0x612000001a20]{BSS_SIZE}: NSE 101: Size retries failed. Selecting next IP-SNS endpoint. Tue Jul 6 10:47:55 2021 DLNS gprs_ns2_sns.c:1431 GPRS-NS2-SNS-BSS(NSE00101-SNS)[0x612000001a20]{BSS_SIZE}: Received Event REQ_SELECT_ENDPOINT ================================================================= ==3130577==ERROR: AddressSanitizer: heap-use-after-free on address 0x6120000018d0 at pc 0x7fe5bc25c85c bp 0x7fff339a3a00 sp 0x7fff339a39f8 READ of size 2 at 0x6120000018d0 thread T0 #0 0x7fe5bc25c85b in osmo_sockaddr_str_from_sockaddr /home/daniel/scm/osmo/libosmocore/src/sockaddr_str.c:359 #1 0x7fe5bc73b10c in gprs_ns2_ll_str_buf /home/daniel/scm/osmo/libosmocore/src/gb/gprs_ns2.c:263 #2 0x7fe5bc742cac in ns2_prim_status_ind /home/daniel/scm/osmo/libosmocore/src/gb/gprs_ns2.c:564 #3 0x7fe5bc743dfe in gprs_ns2_free_nsvc /home/daniel/scm/osmo/libosmocore/src/gb/gprs_ns2.c:639 #4 0x7fe5bc744534 in gprs_ns2_free_nsvcs /home/daniel/scm/osmo/libosmocore/src/gb/gprs_ns2.c:672 #5 0x7fe5bc76f3d5 in ns2_sns_st_all_action_bss /home/daniel/scm/osmo/libosmocore/src/gb/gprs_ns2_sns.c:1583 #6 0x7fe5bc20d574 in _osmo_fsm_inst_dispatch /home/daniel/scm/osmo/libosmocore/src/fsm.c:865 #7 0x7fe5bc7654b5 in ns2_sns_fsm_bss_timer_cb /home/daniel/scm/osmo/libosmocore/src/gb/gprs_ns2_sns.c:1431 #8 0x7fe5bc2115e9 in fsm_tmr_cb /home/daniel/scm/osmo/libosmocore/src/fsm.c:325 #9 0x7fe5bc1f1170 in osmo_timers_update /home/daniel/scm/osmo/libosmocore/src/timer.c:273 #10 0x7fe5bc1f4a6f in _osmo_select_main /home/daniel/scm/osmo/libosmocore/src/select.c:388 #11 0x7fe5bc1f4ad4 in osmo_select_main /home/daniel/scm/osmo/libosmocore/src/select.c:432 #12 0x55dceb7c3363 in main /home/daniel/scm/osmo/osmo-gbproxy/src/gb_proxy_main.c:362 #13 0x7fe5bb5dcd09 in __libc_start_main ../csu/libc-start.c:308 #14 0x55dceb7aca39 in _start (/home/daniel/scm/osmo/osmo-gbproxy/src/osmo-gbproxy+0x46a39) 0x6120000018d0 is located 144 bytes inside of 280-byte region [0x612000001840,0x612000001958) freed by thread T0 here: #0 0x7fe5bd317b6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123 #1 0x7fe5bca0a78a (/usr/lib/x86_64-linux-gnu/libtalloc.so.2+0x478a) previously allocated by thread T0 here: #0 0x7fe5bd317e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 #1 0x7fe5bca0cecb (/usr/lib/x86_64-linux-gnu/libtalloc.so.2+0x6ecb) SUMMARY: AddressSanitizer: heap-use-after-free /home/daniel/scm/osmo/libosmocore/src/sockaddr_str.c:359 in osmo_sockaddr_str_from_sockaddr Shadow bytes around the buggy address: 0x0c247fff82c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa 0x0c247fff82d0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c247fff82e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c247fff82f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa 0x0c247fff8300: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c247fff8310: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd 0x0c247fff8320: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa 0x0c247fff8330: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c247fff8340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c247fff8350: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa 0x0c247fff8360: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==3130577==ABORTING
Updated by lynxis almost 3 years ago
- Status changed from New to Feedback
- % Done changed from 0 to 90
Updated by lynxis almost 3 years ago
- Status changed from Feedback to Closed
- % Done changed from 90 to 100
Actions