hnbgw: remove close_cb() to fix a crash when releasing a hnbgw
The read callback should catch all errors already.
Previous when a read fails it:
* hnb_context_release() -> osmo_stream_srv_destroy() -> hnb_context_release()
On the second hnb_context_release() the hnbgw will crash because calling
llist_del() twice on the same object.
Fixes: OS#3416
Change-Id: Ic84b2184b7fc850c0de2acacf179e86771e17510
diff --git a/src/hnbgw.c b/src/hnbgw.c
index 94d8fb9..91e551b 100644
--- a/src/hnbgw.c
+++ b/src/hnbgw.c
@@ -202,16 +202,6 @@
llist_del(&ue->list);
talloc_free(ue);
}
-static int hnb_close_cb(struct osmo_stream_srv *conn)
-{
- struct hnb_context *hnb = osmo_stream_srv_get_data(conn);
-
- /* This connection is about to be closed. Destroy the HNB context now. */
- if (hnb)
- hnb_context_release(hnb, false);
-
- return 0;
-}
static int hnb_read_cb(struct osmo_stream_srv *conn)
{
@@ -234,10 +224,10 @@
} else if (rc < 0) {
LOGP(DMAIN, LOGL_ERROR, "Error during sctp_recvmsg()\n");
/* FIXME: clean up after disappeared HNB */
- hnb_context_release(hnb, true);
+ hnb_context_release(hnb);
goto out;
} else if (rc == 0) {
- hnb_context_release(hnb, true);
+ hnb_context_release(hnb);
rc = -1;
goto out;
@@ -283,7 +273,7 @@
INIT_LLIST_HEAD(&ctx->map_list);
ctx->gw = gw;
- ctx->conn = osmo_stream_srv_create(tall_hnb_ctx, link, new_fd, hnb_read_cb, hnb_close_cb, ctx);
+ ctx->conn = osmo_stream_srv_create(tall_hnb_ctx, link, new_fd, hnb_read_cb, NULL, ctx);
if (!ctx->conn) {
LOGP(DMAIN, LOGL_INFO, "error while creating connection\n");
talloc_free(ctx);
@@ -294,7 +284,7 @@
return ctx;
}
-void hnb_context_release(struct hnb_context *ctx, bool destroy_conn)
+void hnb_context_release(struct hnb_context *ctx)
{
struct hnbgw_context_map *map, *map2;
@@ -312,8 +302,7 @@
}
ue_context_free_by_hnb(ctx->gw, ctx);
- if (destroy_conn)
- osmo_stream_srv_destroy(ctx->conn);
+ osmo_stream_srv_destroy(ctx->conn);
talloc_free(ctx);
}