pfcp: fix teid leak during session deletion

Release teid previously allocated while releasing session.

Signed-off-by: Alexandre Cassen <acassen@gmail.com>

Author: acassen

lib/pkt_buffer.c

@@ -112,6 +112,7 @@ __pkt_queue_get(struct pkt_queue *q)
 	list_del_init(&pkt->next);
 	__sync_sub_and_fetch(&q->size, 1);
 	pkt_buffer_reset(pkt->pbuff);
+	memset(pkt->pbuff->head, 0, pkt_buffer_size(pkt->pbuff));
 	return pkt;
 }
 

src/pfcp/include/pfcp_session.h

@@ -216,6 +216,7 @@ struct pfcp_session *pfcp_session_alloc(struct gtp_conn *c,
 
 int pfcp_session_alloc_ue_ip(struct pfcp_session *s, sa_family_t af);
 int pfcp_session_release_ue_ip(struct pfcp_session *s);
+int pfcp_session_release_teid(struct pfcp_session *s);
 int pfcp_session_destroy(struct pfcp_session *s);
 int pfcp_sessions_release(struct gtp_conn *c);
 int pfcp_sessions_free(struct gtp_conn *c);

src/pfcp/pfcp_proto_hdl.c

@@ -200,6 +200,7 @@ pfcp_assoc_setup_request_send(struct thread *t)
 
 	/* Prepare pkt */
 	pbuff = p->pbuff;
+	memset(pbuff->head, 0, pkt_buffer_size(pbuff));
 	pfcph = (struct pfcp_hdr *) pbuff->head;
 	pfcph->version = 1;
 	pfcph->type = PFCP_ASSOCIATION_SETUP_REQUEST;

src/pfcp/pfcp_session.c

@@ -346,6 +346,7 @@ pfcp_session_release(struct pfcp_session *s)
 	list_head_del(&s->next);
 	pfcp_session_unhash(s);
 	pfcp_session_release_ue_ip(s);
+	pfcp_session_release_teid(s);
 	pfcp_session_free(s);
 	return 0;
 }

src/pfcp/pfcp_session_ctx.c

@@ -189,6 +189,31 @@ pfcp_session_destroy_teid(struct pfcp_session *s, struct traffic_endpoint *te,
 	return 0;
 }
 
+int
+pfcp_session_release_teid(struct pfcp_session *s)
+{
+	struct pdr *pdr;
+	struct traffic_endpoint *te;
+	int i, j;
+
+	/* Non-optimized pdi */
+	for (i = 0; i < PFCP_MAX_NR_ELEM && s->pdr[i].id; i++) {
+		pdr = &s->pdr[i];
+
+		for (j = 0; j < PFCP_DIR_MAX; j++)
+			pfcp_teid_free(pdr->teid[j]);
+	}
+
+	/* Optimized PDI */
+	for (i = 0; i < PFCP_MAX_NR_ELEM && s->te[i].id; i++) {
+		te = &s->te[i];
+
+		for (j = 0; j < PFCP_DIR_MAX; j++)
+			pfcp_teid_free(te->teid[j]);
+	}
+
+	return 0;
+}
 
 static int
 pfcp_session_create_te(struct pfcp_session *s, struct traffic_endpoint *te,

src/pfcp/pfcp_session_report.c

@@ -85,7 +85,6 @@ pfcp_session_report_send(struct thread *t)
 
 	/* Pkt building */
 	pbuff = p->pbuff;
-	memset(pbuff->head, 0, pkt_buffer_size(pbuff));
 	pfcp_msg_header_init(pbuff, PFCP_SESSION_REPORT_REQUEST, remote_seid->id,
 			     htonl(srv->seqn++));
 	err = pfcp_ie_put_report_type(pbuff, PFCP_IE_REPORT_TYPE_USAR);

src/pfcp/pfcp_teid.c

@@ -344,6 +344,9 @@ pfcp_teid_alloc_static(struct hlist_head *h, uint8_t interface,
 void
 pfcp_teid_free(struct pfcp_teid *t)
 {
+	if (!t)
+		return;
+
 	pfcp_teid_unhash(t);
 	free(t);
 }