Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

UDM crash on initial UE message, Registration Request #9

Closed
bjoern-r opened this issue Apr 10, 2020 · 7 comments
Closed

UDM crash on initial UE message, Registration Request #9

bjoern-r opened this issue Apr 10, 2020 · 7 comments
Assignees
@bjoern-r
Labels
bug Something isn't working UDM

Comments

@bjoern-r
Copy link

Hello I tried to connect free5GS to a virtual gNB and UE, upon first message from UE the AMF crashes.

Trace log from AMF and NGAP+NAS

INFO[2020-04-07T23:24:15+02:00]/go/src/free5gc/src/amf/amf_util/initContext.go:14 free5gc/src/amf/amf_util.InitAmfContext() amfconfig Info: Version[1.0.0] Description[AMF initial local configuration]  AMF=Util
DEBU[2020-04-07T23:24:15+02:00]/home/calee/files/gofree5gc/release/src/free5gc/lib/ngap/ngapSctp/sctp.go:62 free5gc/lib/ngap/ngapSctp.Server() Resolved address '127.0.16.80' to 127.0.16.80  NGAP=NGAP
INFO[2020-04-07T23:24:15+02:00]/home/calee/files/gofree5gc/release/src/free5gc/lib/ngap/ngapSctp/sctp.go:80 free5gc/lib/ngap/ngapSctp.Server() Listen on 127.0.16.80:38412                   NGAP=NGAP
DEBU[2020-04-07T23:24:21+02:00]/home/calee/files/gofree5gc/release/src/free5gc/lib/ngap/ngapSctp/sctp.go:105 free5gc/lib/ngap/ngapSctp.Accept() Accepted Connection from RemoteAddr: 127.0.16.90:38412  NGAP=NGAP
DEBU[2020-04-07T23:24:21+02:00]/home/calee/files/gofree5gc/release/src/free5gc/lib/ngap/ngapSctp/sctp.go:109 free5gc/lib/ngap/ngapSctp.Accept() A new Connection 1.                           NGAP=NGAP
INFO[2020-04-07T23:24:21+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_sctp/amf_ngap_sctp.go:42 free5gc/src/amf/amf_ngap/ngap_sctp.Server.func1() [AMF] NGAP SCTP Accept from: 127.0.16.90:38412  AMF=NGAP
@`, 00150030000004001b00090002f8395000000001005240060180676e62310066000d00000000010002f839000000080015400160  NGAP=NGAPb/ngap/ngapSctp.Start() Read: 127.0.16.90:38412, 0       PR@gnb1f
DEBU[2020-04-07T23:24:21+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_sctp/amf_ngap_sctp.go:100 free5gc/src/amf/amf_ngap/ngap_sctp.(*SCTPListener).forwardData() Packet get: 0x00150030000004001b00090002f8395000000001005240060180676e62310066000d00000000010002f839000000080015400160  AMF=NGAP
INFO[2020-04-07T23:24:21+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:54 free5gc/src/amf/amf_ngap/ngap_handler.HandleNGSetupRequest() [AMF] NG Setup request                        AMF=NGAP
TRAC[2020-04-07T23:24:21+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:60 free5gc/src/amf/amf_ngap/ngap_handler.HandleNGSetupRequest() [NGAP] Decode IE GlobalRANNodeID              AMF=NGAP
TRAC[2020-04-07T23:24:21+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:74 free5gc/src/amf/amf_ngap/ngap_handler.HandleNGSetupRequest() [NGAP] Decode IE RANNodeName                  AMF=NGAP
TRAC[2020-04-07T23:24:21+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:67 free5gc/src/amf/amf_ngap/ngap_handler.HandleNGSetupRequest() [NGAP] Decode IE SupportedTAList              AMF=NGAP
TRAC[2020-04-07T23:24:21+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:81 free5gc/src/amf/amf_ngap/ngap_handler.HandleNGSetupRequest() [NGAP] Decode IE DefaultPagingDRX             AMF=NGAP
TRAC[2020-04-07T23:24:21+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:94 free5gc/src/amf/amf_ngap/ngap_handler.HandleNGSetupRequest() PagingDRX[3]                                  AMF=NGAP
TRAC[2020-04-07T23:24:21+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:116 free5gc/src/amf/amf_ngap/ngap_handler.HandleNGSetupRequest() PLMN_ID[MCC:208 MNC:93] TAC[000001]           AMF=NGAP
TRAC[2020-04-07T23:24:21+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:137 free5gc/src/amf/amf_ngap/ngap_handler.HandleNGSetupRequest() SERVED_TAI_INDEX[0]                           AMF=NGAP
INFO[2020-04-07T23:24:21+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_message/send.go:79 free5gc/src/amf/amf_ngap/ngap_message.SendNGSetupResponse() [AMF] Send NG-Setup response                  AMF=NGAP
DEBU[2020-04-07T23:24:21+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_message/send.go:32 free5gc/src/amf/amf_ngap/ngap_message.SendToRan() [NGAP] Send To Ran [IP: 127.0.16.90:38412]    AMF=NGAP
@"3, 2015002e000004000100050100414d4600600008000002f839cafe0000564001ff0050000d0002f839000100088040112233  NGAP=NGAP/lib/ngap/ngapSctp.SendMsg() Write: 127.0.16.90:38412,  .AMF9V@P
90.y@99Z@p@, 000f404200000500550002000100260018177e004171000d0102f8390000000000000000302e0280800079000f4002f839000000001002f839000001005a4001180070400100  NGAP=NGAP12, @BU&~Aq
DEBU[2020-04-07T23:24:30+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_sctp/amf_ngap_sctp.go:100 free5gc/src/amf/amf_ngap/ngap_sctp.(*SCTPListener).forwardData() Packet get: 0x000f404200000500550002000100260018177e004171000d0102f8390000000000000000302e0280800079000f4002f839000000001002f839000001005a4001180070400100  AMF=NGAP
INFO[2020-04-07T23:24:30+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:887 free5gc/src/amf/amf_ngap/ngap_handler.HandleInitialUEMessage() [AMF] Initial UE Message                      AMF=NGAP
TRAC[2020-04-07T23:24:30+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:893 free5gc/src/amf/amf_ngap/ngap_handler.HandleInitialUEMessage() [NGAP] Decode IE RanUeNgapID                  AMF=NGAP
TRAC[2020-04-07T23:24:30+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:901 free5gc/src/amf/amf_ngap/ngap_handler.HandleInitialUEMessage() [NGAP] Decode IE NasPdu                       AMF=NGAP
TRAC[2020-04-07T23:24:30+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:909 free5gc/src/amf/amf_ngap/ngap_handler.HandleInitialUEMessage() [NGAP] Decode IE UserLocationInformation      AMF=NGAP
TRAC[2020-04-07T23:24:30+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:917 free5gc/src/amf/amf_ngap/ngap_handler.HandleInitialUEMessage() [NGAP] Decode IE RRCEstablishmentCause        AMF=NGAP
TRAC[2020-04-07T23:24:30+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:926 free5gc/src/amf/amf_ngap/ngap_handler.HandleInitialUEMessage() [NGAP] Decode IE UEContextRequest             AMF=NGAP
TRAC[2020-04-07T23:24:30+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:4145 free5gc/src/amf/amf_ngap/ngap_handler.printRanInfo() IP[127.0.16.90:38412] GNbId[00000001]         AMF=NGAP
DEBU[2020-04-07T23:24:30+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:956 free5gc/src/amf/amf_ngap/ngap_handler.HandleInitialUEMessage() New RanUe [RanUeNgapID: 1]                    AMF=NGAP
TRAC[2020-04-07T23:24:30+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:1007 free5gc/src/amf/amf_ngap/ngap_handler.HandleInitialUEMessage() [Initial UE Message] RRC Establishment Cause[3]  AMF=NGAP
DEBU[2020-04-07T23:24:30+02:00]/go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:1011 free5gc/src/amf/amf_ngap/ngap_handler.HandleInitialUEMessage() Trigger initial Context Setup procedure       AMF=NGAP
INFO[2020-04-07T23:24:30+02:00]/go/src/free5gc/src/amf/gmm/gmm_handler/handler.go:492 free5gc/src/amf/gmm/gmm_handler.HandleRegistrationRequest() [AMF] Handle Registration Request             AMF=Gmm
DEBU[2020-04-07T23:24:30+02:00]/go/src/free5gc/src/amf/gmm/gmm_handler/handler.go:512 free5gc/src/amf/gmm/gmm_handler.HandleRegistrationRequest() RegistrationType: Initial Registration        AMF=Gmm
panic: runtime error: slice bounds out of range

goroutine 54 [running]:
free5gc/lib/nas/nasConvert.SuciToString(0xc0001b2a50, 0xd, 0xd, 0xc0001b2a50, 0x0, 0x0, 0x0)
        /home/calee/files/gofree5gc/release/src/free5gc/lib/nas/nasConvert/MobileIdentity5GS.go:54 +0xa31
free5gc/src/amf/gmm/gmm_handler.HandleRegistrationRequest(0xc0000f0000, 0xd95e55, 0xb, 0xf, 0xc0008db6c0, 0x110, 0xc0007a4240)
        /go/src/free5gc/src/amf/gmm/gmm_handler/handler.go:534 +0x105c
free5gc/src/amf/gmm.register_event_3gpp(0xc00009bba0, 0xd95f05, 0xb, 0xc00080ca80, 0xd3f900, 0xc0007a4240)
        /go/src/free5gc/src/amf/gmm/sm.go:43 +0x544
free5gc/src/amf/gmm.DeRegistered_3gpp(0xc00009bba0, 0xd95f05, 0xb, 0xc00080ca80, 0xc0008dad88, 0xc000104668)
        /go/src/free5gc/src/amf/gmm/sm.go:23 +0x49
free5gc/lib/fsm.(*FSM).SendEvent(...)
        /home/calee/files/gofree5gc/release/src/free5gc/lib/fsm/fsm.go:57
free5gc/src/amf/amf_nas.Dispatch(0xc0000f0000, 0xd95e55, 0xb, 0xf, 0xc00000e360, 0xc00000e360, 0x0)
        /go/src/free5gc/src/amf/amf_nas/dispatch.go:19 +0x329
free5gc/src/amf/amf_nas.HandleNAS(0xc0008da750, 0xf, 0xc000028fa0, 0x17, 0x20)
        /go/src/free5gc/src/amf/amf_nas/handler.go:40 +0x10e
free5gc/src/amf/amf_ngap/ngap_handler.HandleInitialUEMessage(0xc00013a000, 0xc00009a2a0)
        /go/src/free5gc/src/amf/amf_ngap/ngap_handler/handler.go:1027 +0x381
free5gc/src/amf/amf_ngap.Dispatch(0xc000160020, 0x11, 0xc0008e4000, 0x46, 0x2000)
        /go/src/free5gc/src/amf/amf_ngap/dispatcher.go:40 +0x386
free5gc/src/amf/amf_handler.Handle()
        /go/src/free5gc/src/amf/amf_handler/handler.go:36 +0x1ec
created by free5gc/src/amf/amf_service.(*AMF).Start
        /go/src/free5gc/src/amf/amf_service/amf_init.go:143 +0x4a9
@free5gc-org free5gc-org added the bug Something isn't working label Apr 10, 2020
@free5gc-org free5gc-org self-assigned this Apr 10, 2020
@anhtrung87vn
Copy link

Hello I tried to connect free5GS to a virtual gNB and UE, upon first message from UE the AMF crashes.

Hi bjoern-r,

Could you please let me know which virtual gNB and UE you are using?
Thanks,
Trung

@bjoern-r
Copy link
Author

Hi Trung,

for now i'm not allowed to tell you, but it is part of a closed/shared source 5g core network product from my employer.

Cheers
Bjoern

@anhtrung87vn
Copy link

Thank Bjoern

@bjoern-r
Copy link
Author

same happens with real gNB and UE

@anhtrung87vn
Copy link

anhtrung87vn commented Apr 20, 2020 •
edited

Hi bjoern-r,

Could you please let me know which real gNB you are using? I would like to purchase one to do a test with 5G core.

Thanks,
Trung.

@free5gc-org
Copy link
Contributor

hi @bjoern-r ,

Do you try the latest version of free5gc? We through we have fix this problem.

Or may you provide your pcap file of initial ue message and your SUPI/SUCI.

Thanks

@free5gc-org free5gc-org changed the title SMF crash on initial UE message, Registration Request AMF crash on initial UE message, Registration Request Apr 20, 2020
@bjoern-r
Copy link
Author

Hi,
now the AMF is not crashing anymore.
However now the udm is failing:

INFO[2020-04-21T21:18:55+02:00]/home/o5gc/go/src/free5gc/src/udm/udm_producer/generate_auth_data.go:34 free5gc/src/udm/udm_producer.HandleGenerateAuthData() supi conversion => imsi-001012342013333       UDM=UEAU
https://127.0.0.1:29510
panic: runtime error: index out of range

goroutine 14 [running]:
free5gc/lib/milenage.milenageF1(0xc0006674a8, 0x0, 0x20, 0xc0006674e8, 0x10, 0x20, 0xc0006673c8, 0x10, 0x10, 0xc000667488, ...)
        /home/release3/gofree5gc/release/src/free5gc/lib/milenage/milenage.go:57 +0x3fb
free5gc/lib/milenage.F1_Test(...)
        /home/release3/gofree5gc/release/src/free5gc/lib/milenage/milenage.go:574
free5gc/src/udm/udm_producer.HandleGenerateAuthData(0xc000086480, 0xc00008636e, 0x21, 0x0, 0x0, 0xc00063c580, 0x20, 0x0, 0xc00002a210, 0x24)
        /home/o5gc/go/src/free5gc/src/udm/udm_producer/generate_auth_data.go:115 +0x757
free5gc/src/udm/udm_handler.Handle()
        /home/o5gc/go/src/free5gc/src/udm/udm_handler/handler.go:39 +0x5f4
created by free5gc/src/udm/udm_service.(*UDM).Start
        /home/o5gc/go/src/free5gc/src/udm/udm_service/udm_init.go:146 +0x57b

For my USIM card i need to specify the SQN value but this is not possible in the webgui.
How do i add the SQN value to the udm?

Cheers
Bjoern

@free5gc-org free5gc-org changed the title AMF crash on initial UE message, Registration Request UDM crash on initial UE message, Registration Request Apr 30, 2020
@free5gc-org free5gc-org assigned bjoern-r and unassigned free5gc-org May 26, 2020
free5gc-org pushed a commit that referenced this issue Jan 18, 2021
@calee0219
Merged in hotfix/change-gitmodule-to-relative-path (pull request #9)
c501e59 
Change Git Module to relative path

Approved-by: 德治邱
@matsumu-y matsumu-y mentioned this issue Jul 6, 2021
Closed
eric5800602 pushed a commit to eric5800602/free5gc that referenced this issue Apr 24, 2022
@free5gc-org
Merge pull request free5gc#9 from zhonglin6666/ADD_HAND_HEARTBEAT_RES…
7851b52 
…PONSE

add handle heartbeat request
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@bjoern-r bjoern-r

Labels
bug Something isn't working UDM
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@bjoern-r @anhtrung87vn @ianchen0119 @free5gc-org