@@ -2,7 +2,7 @@

 Source: open5gs

 Binary: open5gs-common, open5gs-mme, open5gs-sgwc, open5gs-smf, open5gs-amf, open5gs-sgwu, open5gs-upf, open5gs-hss, open5gs-pcrf, open5gs-nrf, open5gs-scp, open5gs-sepp, open5gs-ausf, open5gs-udm, open5gs-pcf, open5gs-nssf, open5gs-bsf, open5gs-udr, open5gs, open5gs-dbg

 Architecture: any

-Version: 2.7.0.69.609c

+Version: 2.7.0.70.3886

 Maintainer: Harald Welte <laforge@gnumonks.org>

 Uploaders: Sukchan Lee <acetcom@gmail.com>

 Homepage: https://open5gs.org

@@ -32,8 +32,8 @@

  open5gs-udr deb net optional arch=any

  open5gs-upf deb net optional arch=any

 Checksums-Sha1:

- 2ea9b4828c7dd73a2cae32e6ad2dce931a01c9e1 14471056 open5gs_2.7.0.69.609c.tar.xz

+ 043b79f4b89da0288be0a716db8f883d0bf5e273 14470684 open5gs_2.7.0.70.3886.tar.xz

 Checksums-Sha256:

- dea6ba114c72d3d159feb69e292314ec47ec45559523e4b95a9d12e195435e87 14471056 open5gs_2.7.0.69.609c.tar.xz

+ 05de41f098b1e976afd37ffb63a60599d0fcaf10c455160690bc1c53ed62bba8 14470684 open5gs_2.7.0.70.3886.tar.xz

 Files:

- cac4e4681f775f3a695dc2e8a178f45a 14471056 open5gs_2.7.0.69.609c.tar.xz

+ b882151d896ef644aebd069f7ea5dec4 14470684 open5gs_2.7.0.70.3886.tar.xz

​

@@ -1 +1 @@

-2.7.0.69-609c

+2.7.0.70-3886

​

@@ -1,8 +1,8 @@

-open5gs (2.7.0.69.609c) unstable; urgency=medium

+open5gs (2.7.0.70.3886) unstable; urgency=medium

   * Automatically generated changelog entry for building the Osmocom master feed

- -- Osmocom OBS scripts <info@osmocom.org>  Wed, 24 Jan 2024 22:42:00 +0000

+ -- Osmocom OBS scripts <info@osmocom.org>  Thu, 25 Jan 2024 14:28:16 +0000

 open5gs (2.7.0) unstable; urgency=medium

​

@@ -146,7 +146,6 @@

     manager = timer->manager;

     ogs_assert(manager);

     timer = ogs_timer_cycle(manager, timer);

-    ogs_assert(timer);

     if (!timer) {

         ogs_fatal("ogs_timer_stop() failed in %s", file_line);

         ogs_assert_if_reached();

​

@@ -407,8 +407,53 @@

         break;

     case MME_EVENT_S6A_MESSAGE:

-        mme_ue = e->mme_ue;

-        ogs_assert(mme_ue);

+        /*

+         * A race condition can occur in the following situations.

+         * In conclusion, we can use this situation to determine

+         * whether or not the UE Context has been removed and avoiding a crash.

+         *

+         * For example, suppose a UE Context is removed in the followings.

+         *

+         * 1. Attach Request

+         * 2. Authentication-Information-Request

+         * 3. Authentication-Information-Answer

+         * 4. Authentication Request

+         * 5. Authentication Response(MAC Failed)

+         * 6. Authentication Reject

+         * 7. UEContextReleaseCommand

+         * 8. UEContextReleaseComplete

+         *

+         * The MME then sends a Purge-UE-request to the HSS and deletes

+         * the UE context as soon as it receives a Purge-UE-Answer.

+         *

+         * Suppose an Attach Request is received from the same UE

+         * between Purge-UE-Request/Answer, then the MME and HSS start

+         * the Authentication-Information-Request/Answer process.

+         *

+         * This can lead to the following situations.

+         *

+         * 1. Purge-UE-Request

+         * 2. Attach Request

+         * 3. Authentication-Information-Request

+         * 4. Purge-UE-Answer

+         * 5. UE Context Removed

+         * 6. Authentication-Information-Answer

+         *

+         * Since the UE Context has already been deleted

+         * when the Authentication-Information-Answer is received,

+         * it cannot be processed properly.

+         *

+         * Therefore, mme_ue_cycle() is used to check

+         * whether the UE Context has been deleted and

+         * decide whether to process or

+         * ignore the Authentication-Information-Answer as shown below.

+         */

+        mme_ue = mme_ue_cycle(e->mme_ue);

+        if (!mme_ue) {

+            ogs_error("UE(mme-ue) context has already been removed");

+            goto cleanup;

+        }

+

         s6a_message = e->s6a_message;

         ogs_assert(s6a_message);

@@ -473,6 +518,8 @@

             ogs_error("Invalid Type%d", s6a_message->cmd_code);

             break;

         }

+

+cleanup:

         ogs_subscription_data_free(&s6a_message->idr_message.subscription_data);

         ogs_subscription_data_free(&s6a_message->ula_message.subscription_data);

         ogs_free(s6a_message);

​

@@ -574,7 +574,28 @@

         emmbuf = NULL;

     }

-    ogs_assert(E_RABToBeSetupListCtxtSUReq->list.count);

+    if (!E_RABToBeSetupListCtxtSUReq->list.count) {

+        ogs_error("    IMSI%s NAS-EPS Type%d "

+                "ENB_UE_S1AP_ID%d MME_UE_S1AP_ID%d",

+                mme_ue->imsi_bcd, mme_ue->nas_eps.type,

+                enb_ue->enb_ue_s1ap_id, enb_ue->mme_ue_s1ap_id);

+        ogs_list_for_each(&mme_ue->sess_list, sess) {

+            ogs_error("    APN%s",

+                    sess->session ? sess->session->name : "Unknown");

+            ogs_list_for_each(&sess->bearer_list, bearer) {

+                if (OGS_FSM_CHECK(&bearer->sm, esm_state_inactive))

+                    ogs_error("    IN-ACTIVE");

+                else if (OGS_FSM_CHECK(&bearer->sm, esm_state_active))

+                    ogs_error("    ACTIVE");

+                else

+                    ogs_error("    OTHER STATE");

+

+                ogs_error("    EBI%d QCI%d SGW-S1U-TEID%d",

+                        bearer->ebi, bearer->qos.index, bearer->sgw_s1u_teid);

+            }

+        }

+        return NULL;

+    }

     ie = CALLOC(1, sizeof(S1AP_InitialContextSetupRequestIEs_t));

     ASN_SEQUENCE_ADD(&InitialContextSetupRequest->protocolIEs, ie);

​