AMF/NSSF crash

[Prajesh-Dhungel]

Hi team,

When the AMF receives the PDU Session Establishment Request, the amf tries to contact NSSF for Network Slice Information.However the NSSF is crashing while trying to generate a network slice instance. I have attached the error logs and the wireshark pcap and kindly request your assistance.

Thankyou in advance

pdu_session_establishment_req.zip

[infinitydon]

Can you provide the configuration that you are using for AMF and NSSF?

[Prajesh-Dhungel]

Please find the below configuration files for amf and nssf.
config.zip

[adejavel]

Hello,
We are facing the same issue in our lab. Do you have any update on this point?

[rijilrose]

Could you please update

[free5gc-org]

Hi @Prajesh-Dhungel ,

Could you provide more packet in pcap file? For now we are supporting that you have send sd == 112233 that you didn't set the snssai under nsiList in the nssfcfg.conf but we cannot check with your pcap file.

[adejavel]

Should it be possible to have a minimalist NSSF config file plz ? I don't understand precisely all the fields
Thanks for the support

[apssoft]

We reproduce the AMF/NSSF crash on the TestRegistration test.
We tried to fix this issue and it seems that this is resolved with our patch.
But we are not sure that this patch is correct.
Can I use this fix?

We use the free5gc v3.0.3.
And these lines in the `config/nssfcfg.conf’ is removed.

diff --git a/config/nssfcfg.conf b/config/nssfcfg.conf
index b166eb8..4f3eb83 100644
--- a/config/nssfcfg.conf
+++ b/config/nssfcfg.conf
@@ -67,12 +67,6 @@ configuration:
       nsiInformationList:
         - nrfId: http://localhost:29510/nnrf-nfm/v1/nf-instances
           nsiId: 21
-    - snssai:
-        sst: 1
-        sd: 010203
-      nsiInformationList:
-        - nrfId: http://localhost:29510/nnrf-nfm/v1/nf-instances
-          nsiId: 22
   amfSetList:
     - amfSetId: 1
       amfList:

Then, `./test.sh TestRegistration’ was crashed.

2020/08/25 09:47:52 map[$and:[map[nfType:NSSF] map[$or:[map[allowedNfTypes:AMF] map[allowedNfTypes:map[$exists:false]]]]]]
[GIN] 2020/08/25 - 09:47:52 | 200 |   31.176161ms |       127.0.0.1 | GET      /nnrf-disc/v1/nf-instances?requester-nf-type=AMF&target-nf-type=NSSF
INFO[2020-08-25T09:47:52+09:00] Request received - NSSelectionGet             NSSF=nsselection
panic: invalid argument to Intn

goroutine 261 [running]:
math/rand.(*Rand).Intn(0xc0001081b0, 0x0, 0x6)
        /usr/local/go/src/math/rand/rand.go:169 +0x9c
math/rand.Intn(...)
        /usr/local/go/src/math/rand/rand.go:337
free5gc/src/nssf/producer.selectNsiInformation(...)
        /home/xxxxx/free5gc/src/nssf/producer/nsselection_for_pdu_session.go:24
free5gc/src/nssf/producer.nsselectionForPduSession(0xc0024076b0, 0xc002137b36, 0x24, 0x0, 0xc0024455e0, 0x0, 0x0, 0x0, 0x0, 0xc001eb9cf8, ...)
        /home/xxxxx/free5gc/src/nssf/producer/nsselection_for_pdu_session.go:117 +0x29b
free5gc/src/nssf/producer.NSSelectionGet(0xc001911bc0, 0xc00248dbf0)
        /home/xxxxx/free5gc/src/nssf/producer/network_slice_information_document.go:133 +0x43f
free5gc/src/nssf/handler.Handle()
        /home/xxxxx/free5gc/src/nssf/handler/handler.go:37 +0x2e1
created by free5gc/src/nssf/service.(*NSSF).Start
        /home/xxxxx/free5gc/src/nssf/service/init.go:114 +0xd1
exit status 2
FAIL    free5gc/src/test        2.647s
INFO[2020-08-25T09:47:55+09:00] /home/xxxxx/free5gc/src/upf/src/up/up_path.c:52 UpRouteTerminate() Removing APN routes  UPF=Util
INFO[2020-08-25T09:47:55+09:00] /home/xxxxx/free5gc/src/upf/src/upf_init.c:297 PacketReceiverThread() Packet receiver thread terminated  UPF=Util

We apply this fix to NSSF.

diff --git a/producer/nsselection_for_pdu_session.go b/producer/nsselection_for_pdu_session.go
index 1d75b63..11a6d84 100644
--- a/producer/nsselection_for_pdu_session.go
+++ b/producer/nsselection_for_pdu_session.go
@@ -114,10 +114,12 @@ func nsselectionForPduSession(param NsselectionQueryParameter,

        nsiInformationList := util.GetNsiInformationListFromConfig(*param.SliceInfoRequestForPduSession.SNssai)

+       if len(nsiInformationList) != 0 {
                nsiInformation := selectNsiInformation(nsiInformationList)

                authorizedNetworkSliceInfo.NsiInformation = new(NsiInformation)
                *authorizedNetworkSliceInfo.NsiInformation = nsiInformation
+       }

        return http.StatusOK
}

The NSSF is not crashed, but AMF is crashed.

[GIN] 2020/08/25 - 09:54:48 | 200 |     829.697μs |       127.0.0.1 | GET      /nnssf-nsselection/v1/network-slice-information?nf-id=1fcffa27-a0f3-4a12-bbbb-226389f432e9&nf-type=AMF&slice-info-request-for-pdu-session=%7B%22sNssai%22%3A%7B%22sst%22%3A1%2C%22sd%22%3A%22010203%22%7D%2C%22roamingIndication%22%3A%22NON_ROAMING%22%7D
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0xc997b0]

goroutine 12 [running]:
free5gc/src/amf/gmm.selectSmf(0xc0008ceb00, 0x144acdb, 0xb, 0xc0002519e0, 0xc001a43a40, 0x14, 0x14, 0xc0001a3a40, 0xc0017a8240, 0x12006e0, ...)
        /home/xxxxx/free5gc/src/amf/gmm/handler.go:319 +0x290
free5gc/src/amf/gmm.HandlePDUSessionEstablishmentRequest(0xc0008ceb00, 0x144acdb, 0xb, 0xc001a43a40, 0x14, 0x14, 0xa, 0x145543d, 0xf, 0xc002cfda60, ...)
        /home/xxxxx/free5gc/src/amf/gmm/handler.go:170 +0x18d
free5gc/src/amf/gmm.HandleULNASTransport(0xc0008ceb00, 0x144acdb, 0xb, 0x2e, 0xc0017deea0, 0xc001892d02, 0x30, 0x30)
        /home/xxxxx/free5gc/src/amf/gmm/handler.go:89 +0x48b
free5gc/src/amf/gmm.register_event_3gpp(0xc00220db40, 0x144af6f, 0xb, 0xc0017a8ae0, 0x13c5e00, 0xc001892d80)
        /home/xxxxx/free5gc/src/amf/gmm/sm.go:40 +0x718
free5gc/src/amf/gmm.Registered_3gpp(0xc00220db40, 0x144af6f, 0xb, 0xc0017a8ae0, 0xc0022214e0, 0x17337d0)
        /home/xxxxx/free5gc/src/amf/gmm/sm.go:24 +0x49
free5gc/lib/fsm.(*FSM).SendEvent(...)
        /home/xxxxx/free5gc/lib/fsm/fsm.go:57
free5gc/src/amf/nas.Dispatch(0xc0008ceb00, 0x144acdb, 0xb, 0x2e, 0xc002cfd900, 0x2e, 0x39)
        /home/xxxxx/free5gc/src/amf/nas/dispatch.go:19 +0x2b5
free5gc/src/amf/nas.HandleNAS(0xc001d07680, 0x2e, 0xc001a62400, 0x35, 0x40)
        /home/xxxxx/free5gc/src/amf/nas/handler.go:41 +0x11a
free5gc/src/amf/ngap.HandleUplinkNasTransport(0xc0008669a0, 0xc002cfc6a0)
        /home/xxxxx/free5gc/src/amf/ngap/handler.go:239 +0x731
free5gc/src/amf/ngap.Dispatch(0xc001d503f0, 0xe, 0xc002efc000, 0x60, 0x2000)
        /home/xxxxx/free5gc/src/amf/ngap/dispatcher.go:45 +0x51a
free5gc/src/amf/handler.Handle()
        /home/xxxxx/free5gc/src/amf/handler/handler.go:35 +0x1db
created by free5gc/src/amf/service.(*AMF).Start
        /home/xxxxx/free5gc/src/amf/service/amf_init.go:150 +0x518
exit status 2
FAIL    free5gc/src/test        2.522s
INFO[2020-08-25T09:54:51+09:00] /home/xxxxx/free5gc/src/upf/src/up/up_path.c:52 UpRouteTerminate() Removing APN routes  UPF=Util
INFO[2020-08-25T09:54:51+09:00] /home/xxxxx/free5gc/src/upf/src/upf_init.c:297 PacketReceiverThread() Packet receiver thread terminated  UPF=Util

We apply this fix to AMF, crash is resolved.

diff --git a/gmm/handler.go b/gmm/handler.go
index e700ba7..391a241 100644
--- a/gmm/handler.go
+++ b/gmm/handler.go
@@ -316,6 +316,10 @@ func selectSmf(ue *context.AmfUe, anType models.AccessType, pduSession *models.P
                }
        }

+       if nsiInformation == nil {
+               pduSession.NsInstance = ""
+               logger.GmmLog.Errorf("nsiInformation is still nil, use default NRF[%s]", nrfUri)
+       } else {
                pduSession.NsInstance = nsiInformation.NsiId
                nrfApiUrl, err := url.Parse(nsiInformation.NrfId)
                if err != nil {
@@ -323,6 +327,7 @@ func selectSmf(ue *context.AmfUe, anType models.AccessType, pduSession *models.P
                } else {
                        nrfUri = fmt.Sprintf("%s://%s", nrfApiUrl.Scheme, nrfApiUrl.Host)
                }
+       }

        param := Nnrf_NFDiscovery.SearchNFInstancesParamOpts{
                ServiceNames: optional.NewInterface([]models.ServiceName{models.ServiceName_NSMF_PDUSESSION}),

[ianchen0119]

Hi @Prajesh-Dhungel

This issue would be closed due to there being no interaction for a while.
If you have any further questions,
please let me know, and I will re-open this issue.

Thanks a lot.