Project

General

Profile

Actions

Bug #5401

closed

null pointer access on type 'struct rtp_stream' in call_leg_ensure_ci()

Added by pespin over 2 years ago. Updated about 2 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Call Control
Target version:
-
Start date:
01/13/2022
Due date:
% Done:

100%

Resolution:
Spec Reference:

Description

Got this while giving a quick test on a 2g<->3g call, with current osmo-msc master.

20220113120029107 DLINP <0016> /git/libosmo-netif/src/stream.c:445 [CONNECTED] osmo_stream_cli_fd_cb(): connected read
20220113120029107 DLINP <0016> /git/libosmo-netif/src/stream.c:324 [CONNECTED] osmo_stream_cli_read(): message received
20220113120029107 DLSS7 <0020> /git/libosmo-sccp/src/osmo_ss7.c:1906 0: asp-asp-clnt-OsmoMSC-A-Iu: xua_cli_read_cb(): sctp_recvmsg() returned 44 (flags=0x80)
20220113120029107 DLM3UA <0023> /git/libosmo-sccp/src/m3ua.c:714 0: asp-asp-clnt-OsmoMSC-A-Iu: Received M3UA Message (XFER:DATA)
20220113120029107 DLM3UA <0023> /git/libosmo-sccp/src/m3ua.c:543 0: asp-asp-clnt-OsmoMSC-A-Iu: m3ua_rx_xfer
20220113120029107 DLM3UA <0023> /git/libosmo-sccp/src/m3ua.c:566 0: asp-asp-clnt-OsmoMSC-A-Iu: m3ua_rx_xfer(): M3UA data header: opc=2=0.0.2 dpc=185=0.23.1
20220113120029107 DLSS7 <0020> /git/libosmo-sccp/src/osmo_ss7_hmrt.c:276 m3ua_hmdc_rx_from_l2(): found dpc=185=0.23.1 as local
20220113120029107 DLSS7 <0020> /git/libosmo-sccp/src/sccp_scrc.c:472 scrc_rx_mtp_xfer_ind_xua: HDR=(CO:CODT,V=0,LEN=0), PART(T=Destination Reference,L=4,D=00000017), PART(T=Segmentation,L=4,D=00000000), PART(T=Data,L=5,D=0180028387)
20220113120029107 DLSCCP <0021> /git/libosmo-sccp/src/sccp_scoc.c:1664 Received CO:CODT for local reference 23
20220113120029107 DLSCCP <0021> /git/libosmo-sccp/src/sccp_scoc.c:1698 SCCP-SCOC(23)[0x612000022120]{ACTIVE}: Received Event RCOC-DT1.ind
20220113120029108 DLSCCP <0021> /git/libosmo-sccp/src/sccp_user.c:175 Delivering N-DATA.indication to SCCP User 'OsmoMSC-A'
20220113120029108 DBSSAP <0011> /git/osmo-msc/src/libmsc/sccp_ran.c:108 (GERAN-A-23) sccp_ran_sap_up(N-DATA.indication)
20220113120029108 DRR <0003> /git/osmo-msc/src/libmsc/ran_peer.c:591 ran_peer(GERAN-A:RI-SSN_PC:PC-0-0-2:SSN-BSSAP)[0x6120000078a0]{READY}: Received Event RAN_PEER_EV_MSG_UP_CO
20220113120029108 DMSC <0007> /git/osmo-msc/src/libmsc/ran_peer.c:407 msc_i(IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP)[0x612000022420]{READY}: Received Event MSC_EV_FROM_RAN_UP_L2
20220113120029108 DMSC <0007> /git/osmo-msc/src/libmsc/msc_i.c:85 msc_a(IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP)[0x6120000225a0]{MSC_A_ST_COMMUNICATING}: Received Event MSC_A_EV_FROM_I_PROCESS_ACCESS_SIGNALLING_REQUEST
20220113120029108 DREF <000b> /git/osmo-msc/src/libmsc/msc_a.c:206 msc_a(IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP)[0x6120000225a0]{MSC_A_ST_COMMUNICATING}: + msc_a_ran_dec: now used by 2 (cc,msc_a_ran_dec)
20220113120029108 DBSSAP <0011> /git/osmo-msc/src/libmsc/msc_a.c:1625 msc_a(IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP)[0x6120000225a0]{MSC_A_ST_COMMUNICATING}: RAN decode: BSSAP DTAP
20220113120029108 DRLL <0000> /git/osmo-msc/src/libmsc/msc_a.c:1228 msc_a(IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP)[0x6120000225a0]{MSC_A_ST_COMMUNICATING}: Dispatching 04.08 message: CC GSM48_MT_CC_CONNECT
20220113120029108 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:2217 trans(CC:CALL_RECEIVED IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP callref-0x2 tid-0) rx CONNECT in state CALL_RECEIVED
20220113120029108 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:225 trans(CC:CALL_RECEIVED IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP callref-0x2 tid-0) stopping pending timer T301
20220113120029108 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:191 trans(CC:CALL_RECEIVED IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP callref-0x2 tid-0) new state CALL_RECEIVED -> CONNECT_REQUEST
20220113120029108 DMNCC <0005> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:237 trans(CC:CONNECT_REQUEST IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP callref-0x2 tid-0) tx MNCC_SETUP_CNF
20220113120029108 DMNCC <0005> /git/osmo-msc/src/libmsc/mncc_builtin.c:299 (call 2) Received message MNCC_SETUP_CNF
20220113120029108 DMNCC <0005> /git/osmo-msc/src/libmsc/mncc_builtin.c:180 (call 2) Acknowledge SETUP.
20220113120029108 DMNCC <0005> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:2006 trans(CC:CONNECT_REQUEST IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP callref-0x2 tid-0) rx MNCC_SETUP_COMPL_REQ
20220113120029108 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:104 trans(CC:CONNECT_REQUEST IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP callref-0x2 tid-0) stopping pending guard timer
20220113120029108 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:121 trans(CC:CONNECT_REQUEST IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP callref-0x2 tid-0) starting guard timer with 180 seconds
20220113120029108 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:2030 trans(CC:CONNECT_REQUEST IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP callref-0x2 tid-0) rx MNCC_SETUP_COMPL_REQ in state CONNECT_REQUEST
20220113120029108 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:191 trans(CC:CONNECT_REQUEST IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP callref-0x2 tid-0) new state CONNECT_REQUEST -> ACTIVE
20220113120029108 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:104 trans(CC:ACTIVE IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP callref-0x2 tid-0) stopping pending guard timer
20220113120029108 DBSSAP <0011> /git/osmo-msc/src/libmsc/msc_a.c:1688 msc_a(IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP)[0x6120000225a0]{MSC_A_ST_COMMUNICATING}: Sending DTAP: CC GSM48_MT_CC_CONNECT_ACK
20220113120029108 DBSSAP <0011> /git/osmo-msc/src/libmsc/ran_msg_a.c:1237 msc_a(IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP)[0x6120000225a0]{MSC_A_ST_COMMUNICATING}: RAN encode: BSSMAP: DTAP
20220113120029109 DMSC <0007> /git/osmo-msc/src/libmsc/msc_a.c:1695 msc_i(IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP)[0x612000022420]{READY}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
20220113120029109 DRR <0003> /git/osmo-msc/src/libmsc/ran_conn.c:117 ran_peer(GERAN-A:RI-SSN_PC:PC-0-0-2:SSN-BSSAP)[0x6120000078a0]{READY}: Received Event RAN_PEER_EV_MSG_DOWN_CO
20220113120029109 DLSCCP <0021> /git/libosmo-sccp/src/sccp_scoc.c:1731 Received SCCP User Primitive (N-DATA.request)
20220113120029109 DLSCCP <0021> /git/libosmo-sccp/src/sccp_scoc.c:1772 SCCP-SCOC(23)[0x612000022120]{ACTIVE}: Received Event N-DATA.req
20220113120029109 DLSS7 <0020> /git/libosmo-sccp/src/sccp_scrc.c:401 sccp_scrc_rx_scoc_conn_msg: HDR=(CO:CODT,V=0,LEN=0), PART(T=Routing Context,L=4,D=00000000), PART(T=Destination Reference,L=4,D=00000013), PART(T=Data,L=5,D=010002030f)
20220113120029109 DLSS7 <0020> /git/libosmo-sccp/src/osmo_ss7_hmrt.c:280 m3ua_hmdc_rx_from_l2(): dpc=2=0.0.2 not local, message is for routing
20220113120029109 DLSS7 <0020> /git/libosmo-sccp/src/osmo_ss7_hmrt.c:227 Found route for dpc=2=0.0.2: pc=0=0.0.0 mask=0x0=0.0.0 via AS as-clnt-OsmoMSC-A-Iu proto=m3ua
20220113120029109 DLSS7 <0020> /git/libosmo-sccp/src/osmo_ss7_hmrt.c:235 rt->dest.as proto is M3UA for dpc=2=0.0.2
20220113120029109 DLSS7 <0020> /git/libosmo-sccp/src/m3ua.c:508 XUA_AS(as-clnt-OsmoMSC-A-Iu)[0x6120000072a0]{AS_ACTIVE}: Received Event AS-TRANSFER.req
20220113120029109 DMNCC <0005> /git/osmo-msc/src/libmsc/mncc_builtin.c:188 (call 2, remote 80000002) Sending CONNECT to remote.
20220113120029109 DMNCC <0005> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:2006 trans(CC:CALL_DELIVERED IMSI-901700000015259:MSISDN-888:TMSI-0x3DBD26B3:UTRAN-Iu-22:CM_SERVICE_REQ callref-0x80000002 tid-8) rx MNCC_SETUP_RSP
20220113120029109 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:104 trans(CC:CALL_DELIVERED IMSI-901700000015259:MSISDN-888:TMSI-0x3DBD26B3:UTRAN-Iu-22:CM_SERVICE_REQ callref-0x80000002 tid-8) stopping pending guard timer
20220113120029109 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:121 trans(CC:CALL_DELIVERED IMSI-901700000015259:MSISDN-888:TMSI-0x3DBD26B3:UTRAN-Iu-22:CM_SERVICE_REQ callref-0x80000002 tid-8) starting guard timer with 180 seconds
20220113120029109 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:2030 trans(CC:CALL_DELIVERED IMSI-901700000015259:MSISDN-888:TMSI-0x3DBD26B3:UTRAN-Iu-22:CM_SERVICE_REQ callref-0x80000002 tid-8) rx MNCC_SETUP_RSP in state CALL_DELIVERED
20220113120029109 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:500 trans(CC:CALL_DELIVERED IMSI-901700000015259:MSISDN-888:TMSI-0x3DBD26B3:UTRAN-Iu-22:CM_SERVICE_REQ callref-0x80000002 tid-8) starting timer T313 with 30 seconds
20220113120029109 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:191 trans(CC:CALL_DELIVERED IMSI-901700000015259:MSISDN-888:TMSI-0x3DBD26B3:UTRAN-Iu-22:CM_SERVICE_REQ callref-0x80000002 tid-8) new state CALL_DELIVERED -> CONNECT_IND
20220113120029109 DIUCS <0010> /git/osmo-msc/src/libmsc/msc_a.c:1688 msc_a(IMSI-901700000015259:MSISDN-888:TMSI-0x3DBD26B3:UTRAN-Iu-22:CM_SERVICE_REQ)[0x612000020da0]{MSC_A_ST_COMMUNICATING}: Sending DTAP: CC GSM48_MT_CC_CONNECT
20220113120029109 DIUCS <0010> /git/osmo-msc/src/libmsc/ran_msg_iu.c:409 msc_a(IMSI-901700000015259:MSISDN-888:TMSI-0x3DBD26B3:UTRAN-Iu-22:CM_SERVICE_REQ)[0x612000020da0]{MSC_A_ST_COMMUNICATING}: RAN encode: RANAP: DirectTransfer
20220113120029109 DMSC <0007> /git/osmo-msc/src/libmsc/msc_a.c:1695 msc_i(IMSI-901700000015259:MSISDN-888:TMSI-0x3DBD26B3:UTRAN-Iu-22:CM_SERVICE_REQ)[0x612000020c20]{READY}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
20220113120029109 DRR <0003> /git/osmo-msc/src/libmsc/ran_conn.c:117 ran_peer(UTRAN-Iu:RI-SSN_PC:PC-0-23-5:SSN-RANAP)[0x61200001a1a0]{READY}: Received Event RAN_PEER_EV_MSG_DOWN_CO
20220113120029109 DLSCCP <0021> /git/libosmo-sccp/src/sccp_scoc.c:1731 Received SCCP User Primitive (N-DATA.request)
20220113120029109 DLSCCP <0021> /git/libosmo-sccp/src/sccp_scoc.c:1772 SCCP-SCOC(22)[0x612000020920]{ACTIVE}: Received Event N-DATA.req
20220113120029109 DLSS7 <0020> /git/libosmo-sccp/src/sccp_scrc.c:401 sccp_scrc_rx_scoc_conn_msg: HDR=(CO:CODT,V=0,LEN=0), PART(T=Routing Context,L=4,D=00000000), PART(T=Destination Reference,L=4,D=000003ec), PART(T=Data,L=24,D=00144014000002001040080783074c03805499003b400100)
20220113120029109 DLSS7 <0020> /git/libosmo-sccp/src/osmo_ss7_hmrt.c:280 m3ua_hmdc_rx_from_l2(): dpc=189=0.23.5 not local, message is for routing
20220113120029109 DLSS7 <0020> /git/libosmo-sccp/src/osmo_ss7_hmrt.c:227 Found route for dpc=189=0.23.5: pc=0=0.0.0 mask=0x0=0.0.0 via AS as-clnt-OsmoMSC-A-Iu proto=m3ua
20220113120029109 DLSS7 <0020> /git/libosmo-sccp/src/osmo_ss7_hmrt.c:235 rt->dest.as proto is M3UA for dpc=189=0.23.5
20220113120029110 DLSS7 <0020> /git/libosmo-sccp/src/m3ua.c:508 XUA_AS(as-clnt-OsmoMSC-A-Iu)[0x6120000072a0]{AS_ACTIVE}: Received Event AS-TRANSFER.req
20220113120029110 DMNCC <0005> /git/osmo-msc/src/libmsc/mncc_builtin.c:195 (call 2, remote 80000002) Bridging with remote.
20220113120029110 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:370 trans(CC:ACTIVE IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP callref-0x2 tid-0) MNCC_BRIDGE: Local bridge to callref 0x80000002
20220113120029110 DCC <0001> /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:371 trans(CC:CONNECT_IND IMSI-901700000015259:MSISDN-888:TMSI-0x3DBD26B3:UTRAN-Iu-22:CM_SERVICE_REQ callref-0x80000002 tid-8) MNCC_BRIDGE: Local bridge to callref 0x2
/git/osmo-msc/src/libmsc/call_leg.c:348:15: runtime error: member access within null pointer of type 'struct rtp_stream'
20220113120029110 DCC <0001> /git/osmo-msc/src/libmsc/rtp_stream.c:392 rtp_stream(IMSI-901700000015256:MSISDN-4599:TMSI-0x892BB4A5:GERAN-A-23:PAGING_RESP:trans-0:call-2:RTP_TO_CN:CI-70415DB9:no-remote-port:local-127-0-0-2-9014)[0x612000023920]{ESTABLISHING}: setting codec to AMR/8000/1

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff4d6f536 in osmo_sockaddr_str_is_set (sockaddr_str=sockaddr_str@entry=0x20) at /git/libosmocore/src/sockaddr_str.c:60
60                        && *sockaddr_str->ip
(gdb) bt
#0  0x00007ffff4d6f536 in osmo_sockaddr_str_is_set (sockaddr_str=sockaddr_str@entry=0x20) at /git/libosmocore/src/sockaddr_str.c:60
#1  0x00007ffff4d705f5 in osmo_sockaddr_str_is_nonzero (sockaddr_str=sockaddr_str@entry=0x20)
    at /git/libosmocore/src/sockaddr_str.c:75
#2  0x000055555581687e in call_leg_ensure_ci (cl=cl@entry=0x60e000060d60, dir=dir@entry=RTP_TO_CN, call_id=call_id@entry=2,
    for_trans=for_trans@entry=0x61d00029aee0, codec_if_known=codec_if_known@entry=0x7fffffff8af0, remote_addr_if_known=remote_addr_if_known@entry=0x20)
    at /git/osmo-msc/src/libmsc/call_leg.c:326
#3  0x0000555555816ee1 in call_leg_local_bridge (cl1=cl1@entry=0x60e000060d60, call_id1=<optimized out>, trans1=trans1@entry=0x61d00029aee0,
    cl2=cl2@entry=0x60e00005d2c0, call_id2=call_id2@entry=2147483650, trans2=trans2@entry=0x61d0002986e0)
    at /git/osmo-msc/src/libmsc/call_leg.c:347
#4  0x000055555595a62d in tch_bridge (net=net@entry=0x6190000082e0, bridge=bridge@entry=0x7fffffff9500)
    at /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:380
#5  0x00005555559738a5 in mncc_tx_to_gsm_cc (net=net@entry=0x6190000082e0, msg=msg@entry=0x7fffffff9500)
    at /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:1867
#6  0x000055555597be8e in mncc_tx_to_cc (net=0x6190000082e0, arg=arg@entry=0x7fffffff9500)
    at /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:2105
#7  0x0000555555861cbd in mncc_setup_cnf (call=call@entry=0x60c0000d3360, connect=connect@entry=0x61d0002af968)
    at /git/osmo-msc/src/libmsc/mncc_builtin.c:197
#8  0x0000555555863b4d in int_mncc_recv (net=<optimized out>, msg=<optimized out>) at /git/osmo-msc/src/libmsc/mncc_builtin.c:307
#9  0x000055555596806d in cc_tx_to_mncc (net=net@entry=0x6190000082e0, msg=msg@entry=0x61d0002af8e0)
    at /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:131
#10 0x00005555559682c9 in mncc_recvmsg (net=0x6190000082e0, trans=trans@entry=0x61d00029aee0, msg_type=msg_type@entry=260, mncc=mncc@entry=0x7fffffffa6b0)
    at /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:248
#11 0x000055555596f1ab in gsm48_cc_rx_connect (trans=0x61d00029aee0, msg=<optimized out>)
    at /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:941
#12 0x000055555597e027 in gsm0408_rcv_cc (msc_a=msc_a@entry=0x61d00029d6e0, msg=msg@entry=0x61a0000516e0)
    at /git/osmo-msc/src/libmsc/gsm_04_08_cc.c:2240
#13 0x0000555555884e2e in msc_a_up_l3 (msc_a=msc_a@entry=0x61d00029d6e0, msg=0x61a0000516e0) at /git/osmo-msc/src/libmsc/msc_a.c:1277
#14 0x00005555558919aa in msc_a_ran_dec_from_msc_i (msc_a=msc_a@entry=0x61d00029d6e0, d=d@entry=0x7fffffffc9f0)
    at /git/osmo-msc/src/libmsc/msc_a.c:1442
#15 0x00005555558949e6 in msc_a_ran_decode_cb (msc_a_fi=<optimized out>, data=0x7fffffffc9f0, msg=0x7fffffffc180)
    at /git/osmo-msc/src/libmsc/msc_a.c:1626
#16 0x00005555558d7ee0 in ran_decoded (ran_dec=ran_dec@entry=0x7fffffffc920, ran_msg=ran_msg@entry=0x7fffffffc180)
    at /git/osmo-msc/src/libmsc/ran_msg.c:155
#17 0x00005555558db69a in ran_a_decode_l3 (ran_dec=ran_dec@entry=0x7fffffffc920, l3=l3@entry=0x61a0000516e0)
    at /git/osmo-msc/src/libmsc/ran_msg_a.c:861
#18 0x00005555558ed60f in ran_a_decode_l2 (ran_dec=ran_dec@entry=0x7fffffffc920, bssap=0x61a0000516e0)
    at /git/osmo-msc/src/libmsc/ran_msg_a.c:885
#19 0x0000555555876f43 in msc_role_ran_decode (fi=0x6120000225a0, an_apdu=an_apdu@entry=0x7fffffffd5c0,
    decode_cb=decode_cb@entry=0x555555894555 <msc_a_ran_decode_cb>, decode_cb_data=decode_cb_data@entry=0x7fffffffc9f0)
    at /git/osmo-msc/src/libmsc/msub.c:593
#20 0x0000555555879509 in msc_a_ran_dec (msc_a=msc_a@entry=0x61d00029d6e0, an_apdu=an_apdu@entry=0x7fffffffd5c0, from_role=from_role@entry=MSC_ROLE_I)
    at /git/osmo-msc/src/libmsc/msc_a.c:207
#21 0x000055555588c011 in msc_a_fsm_communicating (fi=0x6120000225a0, event=9, data=0x7fffffffd5c0)
    at /git/osmo-msc/src/libmsc/msc_a.c:657
--Type <RET> for more, q to quit, c to continue without paging--
#22 0x00007ffff4d1a01f in _osmo_fsm_inst_dispatch (fi=0x6120000225a0, event=event@entry=9, data=data@entry=0x7fffffffd5c0,
    file=file@entry=0x5555559dde80 "/git/osmo-msc/src/libmsc/msc_i.c", line=line@entry=85)
    at /git/libosmocore/src/fsm.c:872
#23 0x0000555555873c5c in _msub_role_dispatch (msub=0x60e00005d560, to_role=to_role@entry=MSC_ROLE_A, to_role_event=to_role_event@entry=9,
    an_apdu=an_apdu@entry=0x7fffffffd5c0, file=file@entry=0x5555559dde80 "/git/osmo-msc/src/libmsc/msc_i.c", line=line@entry=85)
    at /git/osmo-msc/src/libmsc/msub.c:449
#24 0x000055555589a5e6 in msc_i_ready_decode_cb (msc_i_fi=<optimized out>, data=0x7fffffffd5c0, msg=<optimized out>)
    at /git/osmo-msc/src/libmsc/msc_i.c:85
#25 0x00005555558d7ee0 in ran_decoded (ran_dec=ran_dec@entry=0x7fffffffd430, ran_msg=ran_msg@entry=0x7fffffffcc90)
    at /git/osmo-msc/src/libmsc/ran_msg.c:155
#26 0x00005555558db69a in ran_a_decode_l3 (ran_dec=ran_dec@entry=0x7fffffffd430, l3=l3@entry=0x61a0000516e0)
    at /git/osmo-msc/src/libmsc/ran_msg_a.c:861
#27 0x00005555558ed60f in ran_a_decode_l2 (ran_dec=ran_dec@entry=0x7fffffffd430, bssap=0x61a0000516e0)
    at /git/osmo-msc/src/libmsc/ran_msg_a.c:885
#28 0x0000555555876f43 in msc_role_ran_decode (fi=0x612000022420, an_apdu=an_apdu@entry=0x7fffffffd5c0,
    decode_cb=decode_cb@entry=0x55555589a501 <msc_i_ready_decode_cb>, decode_cb_data=decode_cb_data@entry=0x7fffffffd5c0)
    at /git/osmo-msc/src/libmsc/msub.c:593
#29 0x000055555589ba60 in msc_i_fsm_ready (fi=<optimized out>, event=9, data=0x7fffffffd5c0) at /git/osmo-msc/src/libmsc/msc_i.c:110
#30 0x00007ffff4d1a01f in _osmo_fsm_inst_dispatch (fi=0x612000022420, event=event@entry=9, data=data@entry=0x7fffffffd5c0,
    file=file@entry=0x5555559e98c0 "/git/osmo-msc/src/libmsc/ran_peer.c", line=line@entry=407)
    at /git/libosmocore/src/fsm.c:872
#31 0x00005555558f6052 in ran_peer_st_ready (fi=<optimized out>, event=<optimized out>, data=<optimized out>)
    at /git/osmo-msc/src/libmsc/ran_peer.c:407
#32 0x00007ffff4d1a01f in _osmo_fsm_inst_dispatch (fi=fi@entry=0x6120000078a0, event=event@entry=2, data=data@entry=0x7fffffffd720,
    file=file@entry=0x5555559e98c0 "/git/osmo-msc/src/libmsc/ran_peer.c", line=line@entry=591)
    at /git/libosmocore/src/fsm.c:872
#33 0x00005555558fb90b in ran_peer_up_l2 (sri=<optimized out>, calling_addr=<optimized out>, co=<optimized out>, conn_id=<optimized out>, l2=<optimized out>)
    at /git/osmo-msc/src/libmsc/ran_peer.c:591
#34 0x0000555555817d73 in sccp_ran_sap_up (oph=0x61a000051768, _scu=<optimized out>) at /git/osmo-msc/src/libmsc/sccp_ran.c:110
#35 0x00007ffff5fa8901 in sccp_user_prim_up (scu=0x60f000004420, prim=prim@entry=0x61a000051768)
    at /git/libosmo-sccp/src/sccp_user.c:177
#36 0x00007ffff5fa14d1 in scu_gen_encode_and_send (conn=conn@entry=0x6180000684e0, event=event@entry=11, xua=xua@entry=0x60d000050a10,
    primitive=primitive@entry=1, operation=operation@entry=PRIM_OP_INDICATION) at /git/libosmo-sccp/src/sccp_scoc.c:805
#37 0x00007ffff5fa4fd3 in scoc_fsm_active (fi=0x612000022120, event=11, data=0x60d000050a10)
    at /git/libosmo-sccp/src/sccp_scoc.c:1124
#38 0x00007ffff4d1a01f in _osmo_fsm_inst_dispatch (fi=0x612000022120, event=event@entry=11, data=data@entry=0x60d000050a10,
    file=file@entry=0x7ffff600d3c0 "/git/libosmo-sccp/src/sccp_scoc.c", line=line@entry=1698)
    at /git/libosmocore/src/fsm.c:872
#39 0x00007ffff5fa657f in sccp_scoc_rx_from_scrc (inst=inst@entry=0x612000007720, xua=xua@entry=0x60d000050a10)
    at /git/libosmo-sccp/src/sccp_scoc.c:1698
#40 0x00007ffff5f96337 in scrc_rx_mtp_xfer_ind_xua (inst=inst@entry=0x612000007720, xua=xua@entry=0x60d000050a10)
    at /git/libosmo-sccp/src/sccp_scrc.c:479
#41 0x00007ffff5fa7671 in mtp_user_prim_cb (oph=0x61e000154b68, ctx=0x612000007720) at /git/libosmo-sccp/src/sccp_user.c:202
#42 0x00007ffff5fd388c in deliver_to_mtp_user (osu=<optimized out>, xua=xua@entry=0x60d000050940)
--Type <RET> for more, q to quit, c to continue without paging--
    at /git/libosmo-sccp/src/osmo_ss7_hmrt.c:95
#43 0x00007ffff5fd3b34 in hmdt_message_for_distribution (inst=inst@entry=0x6140000024a0, xua=xua@entry=0x60d000050940)
    at /git/libosmo-sccp/src/osmo_ss7_hmrt.c:134
#44 0x00007ffff5fd4b9b in m3ua_hmdc_rx_from_l2 (inst=0x6140000024a0, xua=xua@entry=0x60d000050940)
    at /git/libosmo-sccp/src/osmo_ss7_hmrt.c:278
#45 0x00007ffff5f6e002 in m3ua_rx_xfer (asp=asp@entry=0x6180000090e0, xua=xua@entry=0x60d000050940)
    at /git/libosmo-sccp/src/m3ua.c:577
#46 0x00007ffff5f6ee3f in m3ua_rx_msg (asp=asp@entry=0x6180000090e0, msg=msg@entry=0x61e000153ce0)
    at /git/libosmo-sccp/src/m3ua.c:732
#47 0x00007ffff5fd1709 in xua_cli_read_cb (conn=<optimized out>) at /git/libosmo-sccp/src/osmo_ss7.c:1950
#48 0x00007ffff5dd25a7 in osmo_stream_cli_read (cli=cli@entry=0x6180000094e0) at /git/libosmo-netif/src/stream.c:327
#49 0x00007ffff5dd583d in osmo_stream_cli_fd_cb (ofd=0x6180000094e0, what=<optimized out>) at /git/libosmo-netif/src/stream.c:446
#50 0x00007ffff4d005cf in poll_disp_fds (n_fd=n_fd@entry=8) at /git/libosmocore/src/select.c:361
#51 0x00007ffff4d006cf in _osmo_select_main (polling=polling@entry=0) at /git/libosmocore/src/select.c:399
#52 0x00007ffff4d00815 in osmo_select_main_ctx (polling=polling@entry=0) at /git/libosmocore/src/select.c:455
#53 0x00005555558143d5 in main (argc=<optimized out>, argv=<optimized out>) at /git/osmo-msc/src/osmo-msc/msc_main.c:784

Full log attached.


Files

crash_log.txt crash_log.txt 114 KB pespin, 01/13/2022 11:08 AM
Actions #1

Updated by pespin over 2 years ago

  • Category set to Call Control

call_leg_local_bridge() is calling call_leg_ensure_ci().

In call_leg_local_bridge(), cl2->rtp[RTP_TO_CN] is NULL, and the calculated pointer "&cl2->rtp[RTP_TO_CN]->local" passed to call_leg_ensure_ci() is hence NULL + offset = 0x20.

We probably need to add some checks there to avoid accessing NULL pointers.

Actions #2

Updated by pespin over 2 years ago

This situation happens because in this case the RAB-AssignmentRequest sent MSC->HNBGW->nano3g was never forwarded HNBGW->nano3g (due to an error in my config), which means that entire call leg is never completed. So we should prevent osmo-msc to crash in this scenario.

Actions #3

Updated by pespin over 2 years ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 90
Actions #4

Updated by pespin about 2 years ago

  • Status changed from Feedback to Resolved
  • % Done changed from 90 to 100

Merged, closing.

Actions

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)