Skip to content

Commit

Permalink
[SGWC] Fixed crashing when Create Bearer Response occurs after Delete…
Browse files Browse the repository at this point in the history 
… Bearer Response (open5gs#3109)

If a Create Bearer Response occurs after a Delete Bearer Response,
SGW-C crashes.

The execution is stopped by the following ASSERT
because it tries to access the UL Tunnel
deleted by the Delete Bearer Response.

```
03/28 17:28:41.229: [gtp] DEBUG: [7] LOCAL Find GTPv2 peer [172.22.0.9]:2123 (../lib/gtp/xact.c:949)
03/28 17:28:41.229: [gtp] DEBUG: [7] LOCAL Receive peer [172.22.0.9]:2123 (../lib/gtp/xact.c:966)
03/28 17:28:41.229: [gtp] DEBUG: [7] LOCAL UPD RX-96 peer [172.22.0.9]:2123 (../lib/gtp/xact.c:448)
03/28 17:28:41.229: [sgwc] DEBUG: Create Bearer Response (../src/sgwc/s11-handler.c:707)
03/28 17:28:41.229: [gtp] DEBUG: [7] LOCAL Commit peer [172.22.0.9]:2123 (../lib/gtp/xact.c:629)
03/28 17:28:41.230: [gtp] DEBUG: [7] LOCAL Delete peer [172.22.0.9]:2123 (../lib/gtp/xact.c:1149)
03/28 17:28:41.230: [sgwc] FATAL: sgwc_s11_handle_create_bearer_response: Assertion `ul_tunnel' failed. (../src/sgwc/s11-handler.c:802)
03/28 17:28:41.231: [core] FATAL: backtrace() returned 8 addresses (../lib/core/ogs-abort.c:37)
./open5gs-sgwcd(+0x189b7) [0x5b3c92cf09b7]
./open5gs-sgwcd(+0x13c6d) [0x5b3c92cebc6d]
/open5gs/install/lib/x86_64-linux-gnu/libogscore.so.2(ogs_fsm_dispatch+0x113) [0x70600ed63402]
./open5gs-sgwcd(+0x629d) [0x5b3c92cde29d]
/open5gs/install/lib/x86_64-linux-gnu/libogscore.so.2(+0x11754) [0x70600ed54754]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x8609) [0x70600ecfc609]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x43) [0x70600ec21353]
```

To solve this problem, I have modified to handle the exception appropriately,
display the error situation in the Cause of the Create Bearer Response,
and proceed with the execution.
  • Loading branch information
@acetcom
acetcom committed Apr 7, 2024
1 parent e078b33 commit bbdfca2
Show file tree
Hide file tree
Showing 4 changed files with 362 additions and 16 deletions.
18 changes: 16 additions & 2 deletions src/sgwc/s11-handler.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -799,9 +799,23 @@ void sgwc_s11_handle_create_bearer_response(

/* Find the Tunnel by SGW-S1U-TEID */
ul_tunnel = sgwc_tunnel_find_by_teid(sgwc_ue, be32toh(sgw_s1u_teid->teid));
ogs_assert(ul_tunnel);
if (!ul_tunnel) {
ogs_error("No UL-tunnel [EBI:%d, TEID:0x%x]",
bearer->ebi, be32toh(sgw_s1u_teid->teid));
ogs_gtp_send_error_message(s5c_xact, sess ? sess->pgw_s5c_teid : 0,
OGS_GTP2_CREATE_BEARER_RESPONSE_TYPE,
OGS_GTP2_CAUSE_GRE_KEY_NOT_FOUND);
return;
}
dl_tunnel = sgwc_dl_tunnel_in_bearer(bearer);
ogs_assert(dl_tunnel);
if (!dl_tunnel) {
ogs_error("No DL-tunnel [EBI:%d, TEID:0x%x]",
bearer->ebi, be32toh(sgw_s1u_teid->teid));
ogs_gtp_send_error_message(s5c_xact, sess ? sess->pgw_s5c_teid : 0,
OGS_GTP2_CREATE_BEARER_RESPONSE_TYPE,
OGS_GTP2_CAUSE_CONTEXT_NOT_FOUND);
return;
}

/* Set EBI */
bearer->ebi = rsp->bearer_contexts.eps_bearer_id.u8;
Expand Down
4 changes: 2 additions & 2 deletions src/sgwu/sxa-handler.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,7 @@ void sgwu_sxa_handle_session_establishment_request(

cleanup:
ogs_pfcp_sess_clear(&sess->pfcp);
ogs_pfcp_send_error_message(xact, sess ? sess->sgwu_sxa_seid : 0,
ogs_pfcp_send_error_message(xact, sess ? sess->sgwc_sxa_f_seid.seid : 0,
OGS_PFCP_SESSION_ESTABLISHMENT_RESPONSE_TYPE,
cause_value, offending_ie_value);
}
Expand Down Expand Up @@ -309,7 +309,7 @@ void sgwu_sxa_handle_session_modification_request(

cleanup:
ogs_pfcp_sess_clear(&sess->pfcp);
ogs_pfcp_send_error_message(xact, sess ? sess->sgwu_sxa_seid : 0,
ogs_pfcp_send_error_message(xact, sess ? sess->sgwc_sxa_f_seid.seid : 0,
OGS_PFCP_SESSION_MODIFICATION_RESPONSE_TYPE,
cause_value, offending_ie_value);
}
Expand Down
30 changes: 18 additions & 12 deletions src/smf/s5c-handler.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,14 @@ static void pfcp_sess_timeout(ogs_pfcp_xact_t *xact, void *data)
}
}

static ogs_inline uint32_t get_sender_f_teid(
smf_sess_t *sess, ogs_gtp2_sender_f_teid_t *sender_f_teid)
{
return sess ? sess->sgw_s5c_teid :
sender_f_teid && sender_f_teid->teid_presence == true ?
sender_f_teid->teid : 0;
}

void smf_s5c_handle_echo_request(
ogs_gtp_xact_t *xact, ogs_gtp2_echo_request_t *req)
{
Expand Down Expand Up @@ -507,10 +515,8 @@ void smf_s5c_handle_modify_bearer_request(
}

if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
ogs_gtp2_send_error_message(gtp_xact,
sess ? sess->sgw_s5c_teid :
sender_f_teid->teid_presence == true ?
sender_f_teid->teid : 0,
ogs_gtp2_send_error_message(
gtp_xact, get_sender_f_teid(sess, sender_f_teid),
OGS_GTP2_MODIFY_BEARER_RESPONSE_TYPE, cause_value);
return;
}
Expand Down Expand Up @@ -1194,10 +1200,8 @@ void smf_s5c_handle_bearer_resource_command(
}

if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
ogs_gtp2_send_error_message(xact,
sess ? sess->sgw_s5c_teid :
sender_f_teid->teid_presence == true ?
sender_f_teid->teid : 0,
ogs_gtp2_send_error_message(
xact, get_sender_f_teid(sess, sender_f_teid),
OGS_GTP2_BEARER_RESOURCE_FAILURE_INDICATION_TYPE, cause_value);
return;
}
Expand All @@ -1222,7 +1226,8 @@ void smf_s5c_handle_bearer_resource_command(
}

if (cause_value != OGS_GTP2_CAUSE_REQUEST_ACCEPTED) {
ogs_gtp2_send_error_message(xact, sess ? sess->sgw_s5c_teid : 0,
ogs_gtp2_send_error_message(
xact, get_sender_f_teid(sess, sender_f_teid),
OGS_GTP2_BEARER_RESOURCE_FAILURE_INDICATION_TYPE, cause_value);
return;
}
Expand Down Expand Up @@ -1252,7 +1257,7 @@ void smf_s5c_handle_bearer_resource_command(
if (pf) {
if (reconfigure_packet_filter(pf, &tft, i) < 0) {
ogs_gtp2_send_error_message(
xact, sess ? sess->sgw_s5c_teid : 0,
xact, get_sender_f_teid(sess, sender_f_teid),
OGS_GTP2_BEARER_RESOURCE_FAILURE_INDICATION_TYPE,
OGS_GTP2_CAUSE_SEMANTIC_ERRORS_IN_PACKET_FILTER);
return;
Expand Down Expand Up @@ -1321,7 +1326,7 @@ void smf_s5c_handle_bearer_resource_command(

if (reconfigure_packet_filter(pf, &tft, i) < 0) {
ogs_gtp2_send_error_message(
xact, sess ? sess->sgw_s5c_teid : 0,
xact, get_sender_f_teid(sess, sender_f_teid),
OGS_GTP2_BEARER_RESOURCE_FAILURE_INDICATION_TYPE,
OGS_GTP2_CAUSE_SEMANTIC_ERRORS_IN_PACKET_FILTER);
return;
Expand Down Expand Up @@ -1407,7 +1412,8 @@ void smf_s5c_handle_bearer_resource_command(

if (tft_update == 0 && tft_delete == 0 && qos_update == 0) {
/* No modification */
ogs_gtp2_send_error_message(xact, sess ? sess->sgw_s5c_teid : 0,
ogs_gtp2_send_error_message(
xact, get_sender_f_teid(sess, sender_f_teid),
OGS_GTP2_BEARER_RESOURCE_FAILURE_INDICATION_TYPE,
OGS_GTP2_CAUSE_SERVICE_NOT_SUPPORTED);
return;
Expand Down
Loading

0 comments on commit bbdfca2

Please sign in to comment.