mirror of git://git.sysmocom.de/ofono
3b7d8e003e
There was an issue while running LTE and the connection manager tried to activate the context with CID 1 while it got automatically activated at the same time with CID 4. When the automatic activation happened ofono_gprs_cid_activated got called which tried to assign the context, but that failed since the driver context was considered in use (by the activation call). Eventhough it failed, the context was modified, cid was set to 0 (making cid 1 leak). Then release_context got called which clear pointers assigned to the context. A bit later the activation callback got called, in my case activation failed. Due to the failure it tries to clean up by calling context_settings_free, but unfortunately the pointers where reset above causing ofono to segfault du to null pointer derefs. Instead we make sure assign_context does not touch the context unless it succeeds. Then there is no need to call release_context if assign fails. That ensures the context being intact when the activation callback gets called. 03:23:21 ofonod[545]: Aux: < \r\n+CGEV: ME PDN ACT 4\r\n\r\n+CTZE: +04,0,"19/12/10,04:25:03"\r\n 03:23:21 ofonod[545]: drivers/ubloxmodem/network-registration.c:ctze_notify() tz +04 dst 0 time 19/12/10,04:25:03 03:23:21 ofonod[545]: src/network.c:ofono_netreg_time_notify() net time 2019-12-10 04:25:03 utcoff 3600 dst 0 03:23:22 ofonod[545]: Aux: > AT+CGDCONT?\r 03:23:22 ofonod[545]: drivers/ubloxmodem/gprs-context.c:ublox_gprs_activate_primary() cid 1 Connection manager requests activation, will mark the context in use and assign it cid 1. 03:23:22 ofonod[545]: Aux: < \r\n+CGDCONT: 1,"IP","m2m.tele2.com","",0,0,0,0,0,0\r\n 03:23:22 ofonod[545]: Aux: < +CGDCONT: 4,"IP","m2m.tele2.com.mnc003.mcc248.gprs","100.69.174.133",0,0,0,0,0,0\r\n 03:23:22 ofonod[545]: Aux: < \r\nOK\r\n 03:23:22 ofonod[545]: drivers/atmodem/gprs.c:at_cgdcont_read_cb() ok 1 03:23:22 ofonod[545]: src/gprs.c:ofono_gprs_cid_activated() cid 4 03:23:22 ofonod[545]: Can't assign context to driver for APN. Since its marked in use above, we fail to assign it cid 4. When that fails the cid is cleared an all context pointers are set to NULL. 03:23:22 ofonod[545]: Aux: > AT+CGDCONT=1,"IP","m2m.tele2.com"\r 03:23:22 ofonod[545]: Aux: < \r\nOK\r\n 03:23:22 ofonod[545]: drivers/ubloxmodem/gprs-context.c:cgdcont_cb() ok 1 03:23:22 ofonod[545]: Aux: > AT+CGACT=1,1\r 03:23:22 ofonod[545]: Aux: < \r\n+CME ERROR: 100\r\n 03:23:22 ofonod[545]: drivers/ubloxmodem/gprs-context.c:cgact_enable_cb() ok 0 03:23:22 ofonod[545]: src/gprs.c:pri_activate_callback() 0x853480 03:23:22 ofonod[545]: src/gprs.c:pri_activate_callback() Activating context failed with error: Unknown error Activation callback, and it failed. Will try to clean up, but the pointers are NULL'ed... Dec 10 03:23:22 ofonod[545]: Aborting (signal 11) [/usr/sbin/ofonod] |
||
|---|---|---|
| .. | ||
| audio-settings.c | ||
| bluetooth.h | ||
| call-barring.c | ||
| call-forwarding.c | ||
| call-meter.c | ||
| call-settings.c | ||
| call-volume.c | ||
| cbs.c | ||
| cdma-connman.c | ||
| cdma-netreg.c | ||
| cdma-provision.c | ||
| cdma-sms.c | ||
| cdma-smsutil.c | ||
| cdma-smsutil.h | ||
| cdma-voicecall.c | ||
| common.c | ||
| common.h | ||
| ctm.c | ||
| dbus.c | ||
| emulator.c | ||
| genbuiltin | ||
| gnss.c | ||
| gnssagent.c | ||
| gnssagent.h | ||
| gprs-provision.c | ||
| gprs.c | ||
| handsfree-audio.c | ||
| handsfree.c | ||
| hfp.h | ||
| history.c | ||
| ims.c | ||
| location-reporting.c | ||
| log.c | ||
| lte.c | ||
| main.c | ||
| manager.c | ||
| message-waiting.c | ||
| message.c | ||
| message.h | ||
| modem.c | ||
| netmon.c | ||
| netmonagent.c | ||
| netmonagent.h | ||
| nettime.c | ||
| network.c | ||
| ofono.conf | ||
| ofono.h | ||
| ofono.service.in | ||
| ofono.ver | ||
| phonebook.c | ||
| plugin.c | ||
| private-network.c | ||
| radio-settings.c | ||
| sim-auth.c | ||
| sim.c | ||
| simfs.c | ||
| simfs.h | ||
| simutil.c | ||
| simutil.h | ||
| siri.c | ||
| sms.c | ||
| smsagent.c | ||
| smsagent.h | ||
| smsutil.c | ||
| smsutil.h | ||
| stk.c | ||
| stkagent.c | ||
| stkagent.h | ||
| stkutil.c | ||
| stkutil.h | ||
| storage.c | ||
| storage.h | ||
| ussd.c | ||
| util.c | ||
| util.h | ||
| voicecall.c | ||
| watch.c | ||