tree 48ddf7b0c97525703ddd16361b8b3fafb6b2f2ea
parent f9132b2c85859870401425e856457240673c92c4
author Holger Hans Peter Freyther <holger@moiji-mobile.com> 1412955354 +0200
committer Holger Hans Peter Freyther <holger@moiji-mobile.com> 1412955820 +0200

sgsn: Prevent memory leak and double free

This has been re-produced using the "osmo-pcu emulator" code
and a ping to force segmented SNDCP messages. When the NS link
enters the DEAD/BLOCKED state the msgb would be freed twice.
Once inside gprs_ns_sendmsg and once by the caller. Based on the
return one can not see if the parameter has been deleted.

I changed libosmocore/libosmogb to always free the msgb in case
of an error on the way to gprs_ns_sendmsg. Catch up, avoid the
double free and fix some memory leaks. In case the sending fails
assume the entire segmented message is at end and free the
original input data.

This has been tested by posix suspending/resuming the emulator
process to have the GPRS-NS link go to dead/blocked to alive
and unblocked. The ping recovers and "SIGUSR1" to the SGSN does
not show active memory allocations.

The SGSN calls bssgp_tx_dl_ud at the lowest level and has the
following callchains. Most of them allocate the msgb and have
no early return and transfer ownership already:

<- gprs_llc_tx_u
<- gprs_llc_tx_ui
	<- gsm48_gmm_sendmsg (all callers sane)
		<- _tx_status
		<- _tx_detach_req
	<- gprs_llc_tx_xid (all callers sane)
	<- sndcp_unitdata_req
		<- sndcp_send_ud_frag