gprs_ns2: make gprs_ns2_recv_prim() always take msgb ownership
Have a clear ownership of the msgb to prevent any leaks.
Related: OS#5022
Change-Id: I67e70561e7aae4d4556a02f03a8af6c2daf5ff9c
diff --git a/src/gb/gprs_ns2.c b/src/gb/gprs_ns2.c
index 3699d62..3e023ca 100644
--- a/src/gb/gprs_ns2.c
+++ b/src/gb/gprs_ns2.c
@@ -482,33 +482,43 @@
struct gprs_ns2_vc *nsvc = NULL;
uint16_t bvci, nsei;
uint8_t sducontrol = 0;
+ int rc = 0;
- if (oph->sap != SAP_NS)
- return -EINVAL;
+ if (oph->sap != SAP_NS) {
+ rc = -EINVAL;
+ goto out;
+ }
nsp = container_of(oph, struct osmo_gprs_ns2_prim, oph);
- if (oph->operation != PRIM_OP_REQUEST || oph->primitive != GPRS_NS2_PRIM_UNIT_DATA)
- return -EINVAL;
+ if (oph->operation != PRIM_OP_REQUEST || oph->primitive != GPRS_NS2_PRIM_UNIT_DATA) {
+ rc = -EINVAL;
+ goto out;
+ }
- if (!oph->msg)
- return -EINVAL;
+ if (!oph->msg) {
+ rc = -EINVAL;
+ goto out;
+ }
bvci = nsp->bvci;
nsei = nsp->nsei;
nse = gprs_ns2_nse_by_nsei(nsi, nsei);
- if (!nse)
- return -EINVAL;
+ if (!nse) {
+ rc = -EINVAL;
+ goto out;
+ }
- if (!nse->alive)
- return 0;
+ if (!nse->alive) {
+ goto out;
+ }
nsvc = ns2_load_sharing(nse, bvci, nsp->u.unitdata.link_selector);
/* TODO: send a status primitive back */
if (!nsvc)
- return 0;
+ goto out;
if (nsp->u.unitdata.change == GPRS_NS2_ENDPOINT_REQUEST_CHANGE)
sducontrol = 1;
@@ -516,6 +526,10 @@
sducontrol = 2;
return ns2_tx_unit_data(nsvc, bvci, sducontrol, oph->msg);
+
+out:
+ msgb_free(oph->msg);
+ return rc;
}
/*! Send a STATUS.ind primitive to the specified NS instance user.