sgsn: Fix LLME leak when forcing a reattach
Currently when forceing a reattach by sending a Detach
Request (reattach), the SGSN waits for the Detach Accept until it
frees the MM context (if present) and the LLME. If that message gets
lost or isn't sent by the MS, the LLME is never freed if it isn't
bound to an MM context.
This patch adds code to free the MM context/LLME when forcing a
reattachment.
Sponsored-by: On-Waves ehf
diff --git a/openbsc/src/gprs/gprs_gmm.c b/openbsc/src/gprs/gprs_gmm.c
index 7119816..575ad79 100644
--- a/openbsc/src/gprs/gprs_gmm.c
+++ b/openbsc/src/gprs/gprs_gmm.c
@@ -1153,7 +1153,12 @@
}
/* Force the MS to re-attach */
- return sgsn_force_reattach_oldmsg(msg);
+ rc = sgsn_force_reattach_oldmsg(msg);
+
+ /* TLLI unassignment */
+ gprs_llgmm_assign(llme, llme->tlli, 0xffffffff,
+ GPRS_ALGO_GEA0, NULL);
+ return rc;
}
switch (gh->msg_type) {
@@ -1705,15 +1710,12 @@
int rc;
gprs_llgmm_reset(mmctx->llme);
- /* Delete all existing PDP contexts for this MS */
- delete_pdp_contexts(mmctx, "forced reattach");
+ rc = gsm48_tx_gmm_detach_req(
+ mmctx, GPRS_DET_T_MT_REATT_REQ, GMM_CAUSE_IMPL_DETACHED);
- /* TODO:
- * properly start detach procedure (timeout, wait for ACK) and
- * do nothing if a re-attach is in progress */
+ mm_ctx_cleanup_free(mmctx, "forced reattach");
- return gsm48_tx_gmm_detach_req(
- mmctx, GPRS_DET_T_MT_REATT_REQ, GMM_CAUSE_IMPL_DETACHED);
+ return rc;
}
/* Main entry point for incoming 04.08 GPRS messages */