tree f6a4dbeda9c65b38956c9ad46d15c789016b0249
parent dd4709ccf01fe8d4b1b5e59f31d3908f1f29d135
author Holger Hans Peter Freyther <zecke@selfish.org> 1356198327 +0100
committer Holger Hans Peter Freyther <zecke@selfish.org> 1356198327 +0100

libmsc: Avoid a crash on lchan release during call control

If subscriber A is calling B and has sent a CC Setup message we will
allocate the MO and MT transaction and link them together. When the
BTS or the lchan is failing the BSC API will send a clear request,
as part of the clear request all pending transactions will be released.

As part of taking down the transaction, the remote leg will be informed
and will send a MNCC_REL_REQ. This results in a call to trans_free. The
llist_for_each_entry_safe does not handle removing other elements from
the list and we would segfault.

One way to fix this is to move the transaction list into the subscriber
connection. This might require to create the subscriber connection for
MT handling earlier. Otherwise one could have one transaction list inside
the subscriber connection and a global list for MT- transactions.