Cellular Network Infrastructure » Core Network (CN) » OsmoGGSN (former OpenGGSN)

This one looks really weird. pdp->gsn should never be NULL, since pdp is always related to a gsn_t. In no place pdp->gsn is set to NULL, and actually only place where pdp->gsn is set is in gtp_pdp_newpdp():

(*pdp)->gsn = gsn;

And gsn cannot be NULL there because it's deferred to get access to pdpa before in the same function:

struct pdp_t *pdpa = gsn->pdpa;

However, pdp_freepdp() does this:

memset(pdp, 0, sizeof(struct pdp_t));

So only way pdp->gsn is NULL is that pdp_freepdp was already called on that pdp context.

osmo-ggsn only makes use of pdp_freepdp() in one place and it's not triggered here: cb_conf(type=GTP_DELETE_PDP_REQ), basically because we free the pdp context before that point whenever we do a DeletePdpReq in osmo-ggsn. For other cases, osmo-ggsn calls gtp_freepdp_teardown() which would call the delete_ctx cb and appropiatelly remove it from ippool.

libgtp never calls pdp_freepdp() (which does not call delete_ctx cb), and it should only do it when the user/app doesn't have knowledge abot that pdp context (so no associated structures are managed).

Would be great to know which commit/version was this one running when the crash appeared.

Some log file would have been great too, it would be a lot more clear to understand what happened.