[MME] Crash due to a race condition #2916
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
A race condition can occur in the following situations. In conclusion, we can use this situation to determine whether or not the UE Context has been removed and avoiding a crash. For example, suppose a UE Context is removed in the followings. 1. Attach Request 2. Authentication-Information-Request 3. Authentication-Information-Answer 4. Authentication Request 5. Authentication Response(MAC Failed) 6. Authentication Reject 7. UEContextReleaseCommand 8. UEContextReleaseComplete The MME then sends a Purge-UE-request to the HSS and deletes the UE context as soon as it receives a Purge-UE-Answer. Suppose an Attach Request is received from the same UE between Purge-UE-Request/Answer, then the MME and HSS start the Authentication-Information-Request/Answer process. This can lead to the following situations. 1. Purge-UE-Request 2. Attach Request 3. Authentication-Information-Request 4. Purge-UE-Answer 5. [UE Context Removed] 6. Authentication-Information-Answer Since the UE Context has already been deleted when the Authentication-Information-Answer is received, it cannot be processed properly. Therefore, mme_ue_cycle() is used to check whether the UE Context has been deleted and decide whether to process or ignore the Authentication-Information-Answer as shown below.
acetcom
added a commit
that referenced
this pull request
Feb 8, 2024
When there is no MME-UE Context, going to cleanup without setting s6a_message could cause a segmentation fault. We fixed the problem by moving the location of setting s6a_message to before cleanup.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
A race condition can occur in the following situations. In conclusion, we can use this situation to determine whether or not the UE Context has been removed and avoiding a crash.
For example, suppose a UE Context is removed in the followings.
The MME then sends a Purge-UE-request to the HSS and deletes the UE context as soon as it receives a Purge-UE-Answer.
Suppose an Attach Request is received from the same UE between Purge-UE-Request/Answer, then the MME and HSS start the Authentication-Information-Request/Answer process.
This can lead to the following situations.
Since the UE Context has already been deleted
when the Authentication-Information-Answer is received, it cannot be processed properly.
Therefore, mme_ue_cycle() is used to check
whether the UE Context has been deleted and
decide whether to process or
ignore the Authentication-Information-Answer as shown below.