Cellular Network Infrastructure » Core Network (CN) » OsmoHNBGW

I've looked a bit at the hnbap code in osmo-hnbw, and I think there's a bug related to the hnb_context.

• we allocate a hnb_context when accept()ing the SCTP connection
• we release (free) the context not just when the SCTP connection is down, but also when
  • not being able to transmit a HNB-REGISTER-REJ
  • receiving a HNB-DE-REGISTER-REQ (which is what we receive here)

However, if a remote peer would choose to send us any additional HNBAP or RUA messages over the same association later on, hnb_read_cb() would unconditionally de-reference hnb, which is now a NULL-pointer, in

 struct hnb_context *hnb = osmo_stream_srv_get_data(conn);
 ...
 msg->dst = hnb;
 ...
 hnb->hnbap_stream = msgb_sctp_stream(msg);
 ...
 hnb->rua_stream = msgb_sctp_stream(msg);

So either we guard against this and no longer accept traffic on such an SCTP association, or we don't free the HNB context before the assoc/socket is closed.

I think the latter is the better solution, as we are seeing some 3rd party HNB which are re-using the same association to continue to talk to the HNBGW without shutting it down and creating a new connection.