[smf] make smf_sess_remove idempotent (#18)

Without these improvements, code will segfault on double-frees.
althea-net · Jan 17, 2024 · ac70869 · ac70869
1 parent a6477dd
commit ac70869
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 7 deletions.
diff --git a/lib/core/ogs-pool.h b/lib/core/ogs-pool.h
@@ -105,9 +105,17 @@ typedef uint32_t ogs_pool_id_t;
     if (((pool)->size != (pool)->avail)) \
         ogs_error("%d in '%s[%d]' were not released.", \
                 (pool)->size - (pool)->avail, (pool)->name, (pool)->size); \
-    ogs_free((pool)->free); \
-    ogs_free((pool)->array); \
-    ogs_free((pool)->index); \
+    if ((pool)->free) {\
+        ogs_free((pool)->free); \
+    (pool)->free = NULL; \
+    } \
+    if ((pool)->array) {\
+        ogs_free((pool)->array); \
+    (pool)->array = NULL; \
+    } \
+    if ((pool)->index) {\
+        ogs_free((pool)->index); \
+    (pool)->index = NULL; \
 } while (0)
 
 #define ogs_pool_index(pool, node) (((node) - (pool)->array)+1)

diff --git a/src/smf/context.c b/src/smf/context.c
@@ -1733,10 +1733,14 @@ void smf_sess_remove(smf_sess_t *sess)
     if (sess->policy_association_id)
         ogs_free(sess->policy_association_id);
 
-    if (sess->session.name)
+    if (sess->session.name) {
         ogs_free(sess->session.name);
-    if (sess->full_dnn)
+        sess->session.name = NULL;
+    }
+    if (sess->full_dnn) {
         ogs_free(sess->full_dnn);
+        sess->ful_dnn = NULL;
+    }
 
     if (sess->session.ipv4_framed_routes) {
         for (i = 0; i < OGS_MAX_NUM_OF_FRAMED_ROUTES_IN_PDI; i++) {
@@ -1775,8 +1779,9 @@ void smf_sess_remove(smf_sess_t *sess)
 
     smf_bearer_remove_all(sess);
 
-    ogs_assert(sess->pfcp.bar);
-    ogs_pfcp_bar_delete(sess->pfcp.bar);
+    if (sess->pfcp.bar) {
+        ogs_pfcp_bar_delete(sess->pfcp.bar);
+    }
 
     smf_sess_delete_cp_up_data_forwarding(sess);