Osmocom Open Build Service

commit_38868918330a83fad59292bfcea53801ee6137f5.txt Added

commit_609c234f0ba5ed95b5901b1891b180428948a67d.txt Deleted

open5gs_2.7.0.69.609c.dsc -> open5gs_2.7.0.70.3886.dsc Changed

@@ -2,7 +2,7 @@
 Source: open5gs
 Binary: open5gs-common, open5gs-mme, open5gs-sgwc, open5gs-smf, open5gs-amf, open5gs-sgwu, open5gs-upf, open5gs-hss, open5gs-pcrf, open5gs-nrf, open5gs-scp, open5gs-sepp, open5gs-ausf, open5gs-udm, open5gs-pcf, open5gs-nssf, open5gs-bsf, open5gs-udr, open5gs, open5gs-dbg
 Architecture: any
-Version: 2.7.0.69.609c
+Version: 2.7.0.70.3886
 Maintainer: Harald Welte <laforge@gnumonks.org>
 Uploaders: Sukchan Lee <acetcom@gmail.com>
 Homepage: https://open5gs.org
@@ -32,8 +32,8 @@
  open5gs-udr deb net optional arch=any
  open5gs-upf deb net optional arch=any
 Checksums-Sha1:
- 2ea9b4828c7dd73a2cae32e6ad2dce931a01c9e1 14471056 open5gs_2.7.0.69.609c.tar.xz
+ 043b79f4b89da0288be0a716db8f883d0bf5e273 14470684 open5gs_2.7.0.70.3886.tar.xz
 Checksums-Sha256:
- dea6ba114c72d3d159feb69e292314ec47ec45559523e4b95a9d12e195435e87 14471056 open5gs_2.7.0.69.609c.tar.xz
+ 05de41f098b1e976afd37ffb63a60599d0fcaf10c455160690bc1c53ed62bba8 14470684 open5gs_2.7.0.70.3886.tar.xz
 Files:
- cac4e4681f775f3a695dc2e8a178f45a 14471056 open5gs_2.7.0.69.609c.tar.xz
+ b882151d896ef644aebd069f7ea5dec4 14470684 open5gs_2.7.0.70.3886.tar.xz

open5gs_2.7.0.69.609c.tar.xz/.tarball-version -> open5gs_2.7.0.70.3886.tar.xz/.tarball-version Changed

open5gs_2.7.0.69.609c.tar.xz/debian/changelog -> open5gs_2.7.0.70.3886.tar.xz/debian/changelog Changed

open5gs_2.7.0.69.609c.tar.xz/lib/core/ogs-timer.c -> open5gs_2.7.0.70.3886.tar.xz/lib/core/ogs-timer.c Changed

open5gs_2.7.0.69.609c.tar.xz/src/mme/mme-sm.c -> open5gs_2.7.0.70.3886.tar.xz/src/mme/mme-sm.c Changed

@@ -407,8 +407,53 @@
         break;
 
     case MME_EVENT_S6A_MESSAGE:
-        mme_ue = e->mme_ue;
-        ogs_assert(mme_ue);
+        /*
+         * A race condition can occur in the following situations.
+         * In conclusion, we can use this situation to determine
+         * whether or not the UE Context has been removed and avoiding a crash.
+         *
+         * For example, suppose a UE Context is removed in the followings.
+         *
+         * 1. Attach Request
+         * 2. Authentication-Information-Request
+         * 3. Authentication-Information-Answer
+         * 4. Authentication Request
+         * 5. Authentication Response(MAC Failed)
+         * 6. Authentication Reject
+         * 7. UEContextReleaseCommand
+         * 8. UEContextReleaseComplete
+         *
+         * The MME then sends a Purge-UE-request to the HSS and deletes
+         * the UE context as soon as it receives a Purge-UE-Answer.
+         *
+         * Suppose an Attach Request is received from the same UE
+         * between Purge-UE-Request/Answer, then the MME and HSS start
+         * the Authentication-Information-Request/Answer process.
+         *
+         * This can lead to the following situations.
+         *
+         * 1. Purge-UE-Request
+         * 2. Attach Request
+         * 3. Authentication-Information-Request
+         * 4. Purge-UE-Answer
+         * 5. UE Context Removed
+         * 6. Authentication-Information-Answer
+         *
+         * Since the UE Context has already been deleted
+         * when the Authentication-Information-Answer is received,
+         * it cannot be processed properly.
+         *
+         * Therefore, mme_ue_cycle() is used to check
+         * whether the UE Context has been deleted and
+         * decide whether to process or
+         * ignore the Authentication-Information-Answer as shown below.
+         */
+        mme_ue = mme_ue_cycle(e->mme_ue);
+        if (!mme_ue) {
+            ogs_error("UE(mme-ue) context has already been removed");
+            goto cleanup;
+        }
+
         s6a_message = e->s6a_message;
         ogs_assert(s6a_message);
 
@@ -473,6 +518,8 @@
             ogs_error("Invalid Type%d", s6a_message->cmd_code);
             break;
         }
+
+cleanup:
         ogs_subscription_data_free(&s6a_message->idr_message.subscription_data);
         ogs_subscription_data_free(&s6a_message->ula_message.subscription_data);
         ogs_free(s6a_message);

open5gs_2.7.0.69.609c.tar.xz/src/mme/s1ap-build.c -> open5gs_2.7.0.70.3886.tar.xz/src/mme/s1ap-build.c Changed

@@ -574,7 +574,28 @@
         emmbuf = NULL;
     }
 
-    ogs_assert(E_RABToBeSetupListCtxtSUReq->list.count);
+    if (!E_RABToBeSetupListCtxtSUReq->list.count) {
+        ogs_error("    IMSI%s NAS-EPS Type%d "
+                "ENB_UE_S1AP_ID%d MME_UE_S1AP_ID%d",
+                mme_ue->imsi_bcd, mme_ue->nas_eps.type,
+                enb_ue->enb_ue_s1ap_id, enb_ue->mme_ue_s1ap_id);
+        ogs_list_for_each(&mme_ue->sess_list, sess) {
+            ogs_error("    APN%s",
+                    sess->session ? sess->session->name : "Unknown");
+            ogs_list_for_each(&sess->bearer_list, bearer) {
+                if (OGS_FSM_CHECK(&bearer->sm, esm_state_inactive))
+                    ogs_error("    IN-ACTIVE");
+                else if (OGS_FSM_CHECK(&bearer->sm, esm_state_active))
+                    ogs_error("    ACTIVE");
+                else
+                    ogs_error("    OTHER STATE");
+
+                ogs_error("    EBI%d QCI%d SGW-S1U-TEID%d",
+                        bearer->ebi, bearer->qos.index, bearer->sgw_s1u_teid);
+            }
+        }
+        return NULL;
+    }
 
     ie = CALLOC(1, sizeof(S1AP_InitialContextSetupRequestIEs_t));
     ASN_SEQUENCE_ADD(&InitialContextSetupRequest->protocolIEs, ie);

Changes of Revision 387