tree 358abd4affc3927b2588a5fc4afd502f38273e31
parent 7edc25d9d523b6d16cbf2becd365d83d1da61de9
author Stefan Sperling <ssperling@sysmocom.de> 1527005940 +0200
committer Stefan Sperling <ssperling@sysmocom.de> 1527166656 +0200

fix double-free/use-after-free of pointers in struct e1inp_line

Ensure that pointers in cloned e1inp_lines point to valid memory.
Some members of struct e1inp_line can simply be deep-copied.
Use talloc reference counting for pointers to objects which may
be shared between clones (driver-private state and counters).
Prevents double-free bugs, e.g. when multiple links referring
to the same line are closed.

Also, do not forget to unlink struct e1inp_line's counter group from
the counter list. Fixes use-after-free in rate_ctr_timer_cb() during
osmo-bts shutdown.

Change-Id: I9f4724b4a5a064801591e9acf4f2fd1db006d082
Related: OS#3011
Related: OS#3137