lapd_core: Fix crash in lapd_est_req() function

lapd_est_req() function could be called on uninitialized lapd link
(before lapd_dl_init() and after lapd_dl_exit() functions) due to
invalid usage on higher levels.
In order to prevent using uninitialized lapd link, we should set
LAPD_STATE_NULL state for lapd_datalink in lapd_dl_exit() function.
So all messages for lapd_datalink in null state will be unhandled by
lapd_recv_dlsap() function and lapd_est_req() function will not be
called before lapd_dl_init() function where lapd link state is changed
to idle.

 #0  0x00007f46ecd99aa5 in lapd_est_req (dp=<optimized out>, lctx=0x7f46ed80b8b8) at
     lapd_core.c:1769
 #1  0x00007f46ecd9dda8 in rslms_rx_rll_est_req (msg=msg@entry=0x7f46eeab4940,
     dl=dl@entry=0x7f46ed80b888) at lapdm.c:845
 #2  0x00007f46ecd9fc03 in rslms_rx_rll (lc=0x7f46ed80b398, msg=0x7f46eeab4940) at
     lapdm.c:1157
 #3  lapdm_rslms_recvmsg (msg=0x7f46eeab4940, lc=0x7f46ed80b398) at lapdm.c:1223
 #4  0x00007f46ed63773d in rsl_rx_rll (msg=<optimized out>, trx=<optimized out>) at
     rsl.c:2178
 #5  down_rsl (trx=<optimized out>, msg=<optimized out>) at rsl.c:2541
 #6  0x00007f46ed641529 in sign_link_cb (msg=<optimized out>) at abis.c:169
 #7  0x00007f46ec54b111 in ipaccess_bts_read_cb (link=0x7f46eeab4940, msg=0x0) at
     input/ipaccess.c:807
 #8  0x00007f46ec548a8e in ipa_client_read (link=0x7f46ee26ae30) at input/ipa.c:74
 #9  ipa_client_fd_cb (ofd=<optimized out>, what=1) at input/ipa.c:137
 #10 0x00007f46ecfc726f in osmo_fd_disp_fds (_eset=0x7ffe7a9fcd20, _wset=0x7ffe7a9fcca0,
     _rset=0x7ffe7a9fcc20) at select.c:167
 #11 osmo_select_main (polling=polling@entry=0) at select.c:207
 #12 0x00007f46ed63fc25 in bts_main (argc=5, argv=<optimized out>) at main.c:359
 #13 0x00007f46ebd76f45 in __libc_start_main (main=0x7f46ed61b120 <main>, argc=5,
     argv=0x7ffe7a9fcf18, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>,
 #14 0x00007f46ed61b14e in _start ()

Related: OS#1982
Change-Id: I306dad9b78e3becaef14c5305ec25c312feefe3c
1 file changed
tree: 404ce0af8a1623fdf5b08f0329d1980a815dfd9d
  1. contrib/
  2. debian/
  3. doc/
  4. include/
  5. m4/
  6. src/
  7. tests/
  8. utils/
  9. .gitignore
  10. .gitreview
  11. .mailmap
  12. configure.ac
  13. COPYING
  14. Doxyfile.codec.in
  15. Doxyfile.coding.in
  16. Doxyfile.core.in
  17. Doxyfile.gb.in
  18. Doxyfile.gsm.in
  19. Doxyfile.vty.in
  20. git-version-gen
  21. libosmocodec.pc.in
  22. libosmocoding.pc.in
  23. libosmocore.pc.in
  24. libosmoctrl.pc.in
  25. libosmogb.pc.in
  26. libosmogsm.pc.in
  27. libosmosim.pc.in
  28. libosmovty.pc.in
  29. Makefile.am
  30. osmo-release.mk
  31. README.md
  32. TODO-RELEASE
README.md

libosmocore - set of Osmocom core libraries

This repository contains a set of C-language libraries that form the core infrastructure of many Osmocom Open Source Mobile Communications projects.

Historically, a lot of this code was developed as part of the OpenBSC project, but which are of a more generic nature and thus useful to (at least) other programs that we develop in the sphere of Free Software / Open Source mobile communications.

There is no clear scope of it. We simply move all shared code between the various Osmocom projects in this library to avoid code duplication.

The libosmcoore.git repository build multiple libraries:

  • libosmocore contains some general-purpose functions like select-loop abstraction, message buffers, timers, linked lists
  • libosmovty contains routines related to the interactive command-line interface called VTY
  • libosmogsm contains definitions and helper code related to GSM protocols
  • libosmoctrl contains a shared implementation of the Osmocom control interface
  • libosmogb contains an implementation of the Gb interface with its NS/BSSGP protocols
  • libosmocodec contains an implementation of GSM voice codecs
  • libosmocoding contains an implementation of GSM channel coding
  • libosmosim contains infrastructure to interface SIM/UICC/USIM cards
  • libosmotrau contains encoding/decoding functions for A-bis TRAU frames

Homepage

The official homepage of the project is https://osmocom.org/projects/libosmocore/wiki/Libosmocore

GIT Repository

You can clone from the official libosmocore.git repository using

git clone git://git.osmocom.org/libosmocore.git

There is a cgit interface at http://git.osmocom.org/libosmocore/

Documentation

Doxygen-generated API documentation is generated during the build process, but also available online for each of the sub-libraries at http://ftp.osmocom.org/api/latest/libosmocore/

Mailing List

Discussions related to libosmocore are happening on the openbsc@lists.osmocom.org mailing list, please see https://lists.osmocom.org/mailman/listinfo/openbsc for subscription options and the list archive.

Please observe the Osmocom Mailing List Rules when posting.

Contributing

Our coding standards are described at https://osmocom.org/projects/cellular-infrastructure/wiki/Coding_standards

We us a gerrit based patch submission/review process for managing contributions. Please see https://osmocom.org/projects/cellular-infrastructure/wiki/Gerrit for more details

The current patch queue for libosmocore can be seen at https://gerrit.osmocom.org/#/q/project:libosmocore+status:open