lapd: Check in rslms_rx_rll() if lapdm context was initialized earlier
This was found while implementing handover on a sysmobts. When we
receive a channel release request for a channel that was never really
activated (set_lapdm_context() was not called) we segfault in
lapd_recv_dlsap().
We now return early with -EINVAL in rslms_rx_rll() if we receive a
message that assumes set_lapdm_context() was already called.
These are:
* RSL_MT_UNIT_DATA_REQ
* RSL_MT_DATA_REQ
* RSL_MT_SUSP_REQ
* RSL_MT_REL_REQ
A test case was added to trigger the issue.
diff --git a/src/gsm/lapdm.c b/src/gsm/lapdm.c
index 1c08113..2bda48a 100644
--- a/src/gsm/lapdm.c
+++ b/src/gsm/lapdm.c
@@ -1069,8 +1069,24 @@
return -EINVAL;
}
- LOGP(DLLAPD, LOGL_INFO, "(%p) RLL Message '%s' received. (sapi %d)\n",
- lc->name, rsl_msg_name(msg_type), sapi);
+ switch (msg_type) {
+ case RSL_MT_UNIT_DATA_REQ:
+ case RSL_MT_DATA_REQ:
+ case RSL_MT_SUSP_REQ:
+ case RSL_MT_REL_REQ:
+ /* This is triggered in abnormal error conditions where
+ * set_lapdm_context() was not called for the channel earlier. */
+ if (!dl->dl.lctx.dl) {
+ LOGP(DLLAPD, LOGL_NOTICE, "(%p) RLL Message '%s' received without LAPDm context. (sapi %d)\n",
+ lc->name, rsl_msg_name(msg_type), sapi);
+ msgb_free(msg);
+ return -EINVAL;
+ }
+ break;
+ default:
+ LOGP(DLLAPD, LOGL_INFO, "(%p) RLL Message '%s' received. (sapi %d)\n",
+ lc->name, rsl_msg_name(msg_type), sapi);
+ }
switch (msg_type) {
case RSL_MT_UNIT_DATA_REQ: