ns2_fr: Fix null pointer deref in error path
The followign happens if osmo-gbproxy is started without CAP_NET_RAW:
<0026> gprs_ns2_fr.c:515 BIND(hdlcnet1) Can not create AF_PACKET socket. Are you root or have CAP_NET_RAW?
gprs_ns2_fr.c:176:2: runtime error: member access within null pointer of type 'struct msgb' AddressSanitizer:DEADLYSIGNAL
the second line is free_bind() iterating overr the backlog while
destroying the not-yet-fully-initialized bind.
Let's make sure the backlog llist_head is always initialized properly.
Change-Id: I4d2fa50955c5897cd469fee68d4ddc65a9f5688f
diff --git a/src/gb/gprs_ns2_fr.c b/src/gb/gprs_ns2_fr.c
index 93b7759..2df5986 100644
--- a/src/gb/gprs_ns2_fr.c
+++ b/src/gb/gprs_ns2_fr.c
@@ -807,6 +807,7 @@
goto err_bind;
}
+ INIT_LLIST_HEAD(&priv->backlog.list);
OSMO_STRLCPY_ARRAY(priv->netif, netif);
/* FIXME: move fd handling into socket.c */
@@ -836,7 +837,6 @@
rc = open_socket(priv->ifindex, bind);
if (rc < 0)
goto err_fr;
- INIT_LLIST_HEAD(&priv->backlog.list);
priv->backlog.retry_us = 2500; /* start with some non-zero value; this corrsponds to 496 bytes */
osmo_timer_setup(&priv->backlog.timer, fr_backlog_timer_cb, bind);
osmo_fd_setup(&priv->backlog.ofd, rc, OSMO_FD_READ, fr_netif_ofd_cb, bind, 0);