Skip to content

Merge mme app and nas task and remove lock on UE context #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 37 commits into
base: rsarwad_merge_csfb_call_sms
Choose a base branch
from

Conversation

rsarwad
Copy link
Owner

@rsarwad rsarwad commented Jan 16, 2020

Summary: Nas task is removed, the messages received at nas task are now will be routed to mme app task.
Removed the lock on UE context.
MME app timers are changed similar to nas timers, as part of merging mme app and nas tasks

Type: Refactor
Test plan: Executed s1ap tester test suite

rsarwad and others added 30 commits December 23, 2019 09:52
1. Removed the lock on ue context
2. Modified the mme app timers similar to nas timers
3. Removed the nas task
Summary: Bug happened when adding existing equipment to position and going to ports table.

Reviewed By: AmitArbel

Differential Revision: D19373192

fbshipit-source-id: 4f26ec32bcc68c7afc6f89d2a56d55059f2064d2
Summary: Layers didn't have a scrollbar.

Reviewed By: AmitArbel

Differential Revision: D19364039

fbshipit-source-id: 916b19540e2d25d2bfbec98cfe2584b2cb524204
Summary: Making rows selectable and improving flow

Reviewed By: AmitArbel

Differential Revision: D19371996

fbshipit-source-id: c84dfa9be25f52139552865330a533ef87c3fc3b
…eturning connections

Summary: Pull Request resolved: https://github.com/facebookincubator/symphony/pull/219

Reviewed By: idoshveki

Differential Revision: D19410483

fbshipit-source-id: 7bdbc0df9b01fcb8bc8bfa1064a3d8654d04ff4f
Reviewed By: dlvhdr

Differential Revision: D19427672

fbshipit-source-id: 412accd8dfaf6cbb8196566f44def7711ac0809a
Summary: Pull Request resolved: https://github.com/facebookincubator/symphony/pull/221

Reviewed By: dlvhdr

Differential Revision: D19427660

fbshipit-source-id: 8db5af7582a5ea8036abb6da0ab6bb668a2c2bf2
Summary: See task

Reviewed By: alexsn

Differential Revision: D19428251

fbshipit-source-id: 5d1cdb5f748424525e66a596ac00ac7077341e68
Summary:
Pull Request resolved: https://github.com/facebookincubator/symphony/pull/223

returning locations having externalId containing the query param as well

Reviewed By: idoshveki

Differential Revision: D19429548

fbshipit-source-id: 929341a146f13901ffe38dfe5bd669d3a4b81ee8
Summary: Improving Look&Feel and using design system

Reviewed By: dlvhdr

Differential Revision: D19407977

fbshipit-source-id: 96f3e9a5e9a7d162d8212d794673e93b951694a0
Summary:
Configure a rule to add labels to new firing alerts. Implemented in both PrometheusEditor and EventRuleEditor.

* add new labels
* edit existing labels
* remove labels
* reset form state
* filters out networkID and severity since they are automatic

https://pxl.cl/WDXV
https://pxl.cl/WDXZ

Reviewed By: rckclmbr

Differential Revision: D19395065

fbshipit-source-id: 91b72466e63b1e563020fd1209c6f80b79762578
Summary: title explains it

Reviewed By: fannycchen

Differential Revision: D19416453

fbshipit-source-id: 4807933b2740ec6068721bde1831009fb8989e2b
Summary:
Pull Request resolved: https://github.com/facebookincubator/symphony/pull/207

- In addition to "skipLines" (previous diff) I've added the (default and currently only) option to verify uploads before saving

- Equipment instances will be saved if all rows (except "skip" ones) pass the verification step only.
- All errors are returned to the client, and only the first one is shown at the moment.

Next step:
- Client: show the client (nicely) "you have 4 lines with errors, these are the errors" with options of :
a = Commit the rest (will send the server the same file with "skip_lines" array and verify_before_commit=false)
b = abort process.

Reviewed By: a8m

Differential Revision: D19286398

fbshipit-source-id: a6f8041610e9d8ecd3169d0d819bb0c95c18f0a4
Summary: Trimming name on blur

Reviewed By: dlvhdr

Differential Revision: D19428460

fbshipit-source-id: 9ce392038fd37ee9857edacbaf729d0e90704fe3
Summary:
As we merge the MME and NAS tasks into one, this change implements the changes to merge CSFB procedures for MO/MT call and SMS, MM information, Non EPS Alert and  UE activity Indication.
Type: Refactor
Pull Request resolved: magma#1057

Test Plan: Executed s1ap tester test suite

Reviewed By: ulaskozat

Differential Revision: D19412128

Pulled By: ssanadhya

fbshipit-source-id: 13300b1a6ffbd8a067a76ccb4b7181f09ef08030
Summary:
The State converter class for MME has memory leakage due to multiple bstring
allocation. This change frees up the memory for each bstring.

Reviewed By: ardzoht

Differential Revision: D18423543

fbshipit-source-id: 4795bb8daf7751e7c29a436cd34ed21a402b6440
Summary:
When MME receives a SIGTERM signal, a terminate message is sent to all ITTI
tasks. If NAS task tries to read the mme_nas_state after the MME task has
terminated a segmentation fault is triggered.

Similarly, if PGW task tries to read the spgw_state after the SGW task has already
terminated, it fails the assert on non-null state. This change skips the
spgw_state lookup when PGW task receives a Terminate message.

Reviewed By: andreilee

Differential Revision: D19200343

fbshipit-source-id: 8384fb3b42477b715b1ea7bd98a342812c7213a7
Summary:
Pull Request resolved: https://github.com/facebookincubator/symphony/pull/170

Adds a return value to `Execute()` which holds the actionIDs of successfully executed actions, as well as an array of error messages with its associated actionID.

Reviewed By: rckclmbr

Differential Revision: D19204025

fbshipit-source-id: a9f2bd706ba42719d7240a10486dcba8adfc8bfe
Summary: Not sure this is the best way to fix this, we basically can't compute the status on the fly each time, so need to compute it when we fetch the data from the server

Reviewed By: rckclmbr

Differential Revision: D19401561

fbshipit-source-id: cfa9e58bf64422b8014dd6477a2c2504468c2acd
Reviewed By: rckclmbr

Differential Revision: D19416826

fbshipit-source-id: a2ce23004855aedd0723f822a91d403a9e2d8fd0
@@ -701,21 +698,6 @@ void mme_app_handle_initial_ue_message(mme_app_desc_t *mme_app_desc_p,
DevMessage("mme_create_new_ue_context");
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove devmessage

mme_ue_s1ap_id);
OAILOG_FUNC_OUT(LOG_MME_APP);
}

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

remove extra lines

ue_context_p->sgs_context->mt_call_in_progress = true;
if (ue_context_p->sgs_context->call_cancelled) {
/* Sending Service Reject to UE as MSC/VLR has triggered
* SGSAP SERVICE ABORT
* If UE's ECM state is IDLE send
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Put comments in separately


OAILOG_INFO(
mme_app_desc_p = get_mme_nas_state(false);
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make generic function to pass arg and timer statement

@@ -240,6 +144,16 @@ ue_mm_context_t *mme_create_new_ue_context(void)
new_p->implicit_detach_timer.id = MME_APP_TIMER_INACTIVE_ID;

new_p->initial_context_setup_rsp_timer.id = MME_APP_TIMER_INACTIVE_ID;
new_p->initial_context_setup_rsp_timer.sec =
MME_APP_INITIAL_CONTEXT_SETUP_RSP_TIMER_VALUE;
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Initialize timer structures in single line

@@ -88,51 +96,62 @@ static void mme_app_send_sgs_eps_detach_indication(

itti_send_msg_to_task(TASK_SGS, INSTANCE_DEFAULT, message_p);

nas_itti_timer_arg_t timer_callback_fun = {0};
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Initialize callback fun arg in single arg and move the call back initialization within if and else

@@ -264,18 +333,27 @@ void mme_app_send_sgs_imsi_detach_indication(
SGSAP_IMSI_DETACH_IND(message_p).noneps_detach_type = detach_type;

itti_send_msg_to_task(TASK_SGS, INSTANCE_DEFAULT, message_p);
nas_itti_timer_arg_t timer_callback_fun = {0};
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above

** **
** Inputs: args: handler parameters **
** **
** Outputs: **
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove ouputs

@@ -116,6 +116,9 @@ void free_esm_context_content(esm_context_t *esm_ctx)
if (esm_ctx) {
nas_stop_T3489(esm_ctx);
if (esm_ctx->esm_proc_data) {
if (esm_ctx->esm_proc_data->apn) {
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove the if check

if (!timer_exists(timer_id)) {
return;
OAILOG_FUNC_IN(LOG_NAS);
if ((!timer_exists(timer_id)) || (cb->nas_timer_callback == NULL)) {
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Put error log "timer id is invalid"

Murtadha Al-Tameemi and others added 5 commits January 16, 2020 23:24
Reviewed By: apbuteau

Differential Revision: D19439150

fbshipit-source-id: c8e615aa4906c361ed5452fcdf7594dec7ff8f9c
Reviewed By: rckclmbr

Differential Revision: D19427934

fbshipit-source-id: fea9b4d8f646069105b482f42ba7271a7b187da9
Summary:
Python Ryu 4.50 breaks python eventlet 0.23. So we have to avoid that version.
Setup.py contains the python dependencies to build AGW. Adding this line to the setup.py will force an evenl version higher than 0.23

Reviewed By: tmdzk

Differential Revision: D19442865

fbshipit-source-id: 1a5d637503e0e5320481def6ac532ca38e54fe8f
Summary:
- Append module name to configs secret volumes to allow using the same secret for different module configs
- Bump chart versions and dependencies

Reviewed By: alexsn

Differential Revision: D19441883

fbshipit-source-id: 0a32834e9a86905132cab1d65f6480827d47aa49
@rsarwad rsarwad force-pushed the rsarwad_merge_mme_app_nas_task branch from 50b7d7d to f433a72 Compare January 17, 2020 17:22
rsarwad pushed a commit that referenced this pull request Jun 18, 2020
Summary:
ASAN error:
```
Jun 16 08:56:03 magma-dev sessiond[9856]: =================================================================
Jun 16 08:56:03 magma-dev sessiond[9856]: ==9856==ERROR: AddressSanitizer: new-delete-type-mismatch on 0x61800001fc80 in thread T14:
Jun 16 08:56:03 magma-dev sessiond[9856]:   object passed to delete has wrong type:
Jun 16 08:56:03 magma-dev sessiond[9856]:   size of the allocated type:   816 bytes;
Jun 16 08:56:03 magma-dev sessiond[9856]:   size of the deallocated type: 808 bytes.
Jun 16 08:56:03 magma-dev sessiond[9856]: I0616 08:56:03.149473  9886 SessionEvents.cpp:53] Could not log session_created event {"session_id":"IMSI001010000000001-120251","imsi":"IMSI001010000000001"}, Error Message: Connect Failed
Jun 16 08:56:03 magma-dev sessiond[9856]:     #0 0x7ff448b0d7f0 in operator delete(void*, unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc37f0)
Jun 16 08:56:03 magma-dev sessiond[9856]:     #1 0x559f94cbc742 in magma::AsyncGRPCRequest<magma::lte::LocalSessionManager::WithAsyncMethod_ReportRuleStats<magma::lte::LocalSessionManager::WithAsyncMethod_CreateSession<magma::lte::LocalSessionManager::WithAsyncMethod_EndSession<magma::lte::LocalSessionManager::Service> > >, magma::lte::LocalCreateSessionRequest, magma::lte::LocalCreateSessionResponse>::proceed() /home/vagrant/magma/lte/gateway/c/session_manager/SessionManagerServer.cpp:98
Jun 16 08:56:03 magma-dev sessiond[9856]:     #2 0x559f94ca8f54 in magma::AsyncService::wait_for_requests() /home/vagrant/magma/lte/gateway/c/session_manager/SessionManagerServer.cpp:39
Jun 16 08:56:03 magma-dev sessiond[9856]:     #3 0x559f94c7cae9 in operator() /home/vagrant/magma/lte/gateway/c/session_manager/sessiond_main.cpp:259
Jun 16 08:56:03 magma-dev sessiond[9856]:     #4 0x559f94c81c51 in _M_invoke<> /usr/include/c++/6/functional:1391
Jun 16 08:56:03 magma-dev sessiond[9856]:     #5 0x559f94c81a70 in operator() /usr/include/c++/6/functional:1380
Jun 16 08:56:03 magma-dev sessiond[9856]:     #6 0x559f94c8192b in _M_run /usr/include/c++/6/thread:197
Jun 16 08:56:03 magma-dev sessiond[9856]:     #7 0x7ff446dbde6e  (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xb9e6e)
Jun 16 08:56:03 magma-dev sessiond[9856]:     #8 0x7ff447d384a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
Jun 16 08:56:03 magma-dev sessiond[9856]:     #9 0x7ff446532d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)
Jun 16 08:56:03 magma-dev sessiond[9856]: 0x61800001fc80 is located 0 bytes inside of 816-byte region [0x61800001fc80,0x61800001ffb0)
Jun 16 08:56:03 magma-dev sessiond[9856]: allocated by thread T14 here:
Jun 16 08:56:03 magma-dev sessiond[9856]:     #0 0x7ff448b0cbf0 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc2bf0)
Jun 16 08:56:03 magma-dev sessiond[9856]:     #1 0x559f94ca91f0 in magma::LocalSessionManagerAsyncService::init_call_data() /home/vagrant/magma/lte/gateway/c/session_manager/SessionManagerServer.cpp:60
```

According to the internet, "Polymorphic base classes should declare virtual destructors. If a class has any virtual functions, it should have a virtual destructor".
Resource : https://stackoverflow.com/questions/41552966/getting-new-delete-type-mismatch-from-asan

Reviewed By: uri200

Differential Revision: D22065108

fbshipit-source-id: ff146a9a92f71408ea25dc86943938ca5afe88a1
rsarwad pushed a commit that referenced this pull request Jul 17, 2020
Summary:
This is pull request was created automatically because we noticed your project was missing a Code of Conduct file.

Code of Conduct files facilitate respectful and constructive communities by establishing expected behaviors for project contributors.

This PR was crafted with love by Facebook's Open Source Team.

Pull Request resolved: magma/fbc-js-core#2

Reviewed By: dlvhdr

Differential Revision: D22570984

Pulled By: a8m

fbshipit-source-id: 7d95f1cd14f40d884e64e894819f61f9fa15c5de
rsarwad pushed a commit that referenced this pull request Nov 30, 2020
* Add T3489 tests

Introduce a new test to validate T3489 expiry.

Credit to ulaskozat for the diff

Testing done:
Verified that an ASAN use after free occurs on timer expiry

=7031==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000093460 at pc 0x555807545462 bp 0x7f87093fd2b0 sp 0x7f87093fd2a8
WRITE of size 8 at 0x603000093460 thread T16
    #0 0x555807545461 in nas_stop_T3489 /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/esm_data_context.c:101
    #1 0x5558075c47c5 in esm_proc_esm_information_response /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/esm_information.c:119
    #2 0x55580759339b in esm_recv_information_response /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/sap/esm_recv.c:575
    #3 0x555807551fba in _esm_sap_recv /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/sap/esm_sap.c:679
    #4 0x555807550f33 in esm_sap_send /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/sap/esm_sap.c:283
    #5 0x5558075195a0 in lowerlayer_data_ind /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/emm/LowerLayer.c:276
    #6 0x55580757848f in _emm_as_data_ind /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/emm/sap/emm_as.c:688
    #7 0x555807574ec4 in emm_as_send /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/emm/sap/emm_as.c:180
    #8 0x55580753147f in emm_sap_send /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/emm/sap/emm_sap.c:105
    #9 0x5558074d74fc in nas_proc_ul_transfer_ind /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/nas_proc.c:326
    #10 0x5558071bd634 in handle_message /home/vagrant/magma/lte/gateway/c/oai/tasks/mme_app/mme_app_main.c:97
    #11 0x7f871bb277bd in zloop_start (/usr/lib/x86_64-linux-gnu/libczmq.so.4+0x287bd)
    #12 0x5558071bf169 in mme_app_thread /home/vagrant/magma/lte/gateway/c/oai/tasks/mme_app/mme_app_main.c:447
    #13 0x7f871e11f4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
    #14 0x7f871a494d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)

0x603000093460 is located 0 bytes inside of 32-byte region [0x603000093460,0x603000093480)
freed by thread T16 here:
    #0 0x7f871e602a10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)
    #1 0x5558070dc054 in free_wrapper /home/vagrant/magma/lte/gateway/c/oai/common/dynamic_memory_check.c:47
    #2 0x555807545496 in nas_stop_T3489 /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/esm_data_context.c:103
    #3 0x5558075c517a in _esm_information /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/esm_information.c:269
    #4 0x5558075c4e15 in _esm_information_t3489_handler /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/esm_information.c:199
    #5 0x5558074e2e8a in mme_app_nas_timer_handle_signal_expiry /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/util/nas_timer.c:100
    #6 0x5558071be2d2 in handle_message /home/vagrant/magma/lte/gateway/c/oai/tasks/mme_app/mme_app_main.c:235
    #7 0x7f871bb277bd in zloop_start (/usr/lib/x86_64-linux-gnu/libczmq.so.4+0x287bd)

Signed-off-by: Amar Padmanabhan <[email protected]>

* Invalidate the T3849 timer id while processing esm information retransmit

The _esm_information function stops the existing T3849 timer as referenced
by the esm_ctxt datastructure timer before rescheduling a new T3849 timer
when it requests for the esm info from a UE.
Stopping the timer has a side effect of freeing up the UE related
retransmission data associated with it. This causes issues during
the T3849 timer expiry handling as the cancelled timer and the rescheduled
one reuse the same retransmission data datastructure.

Fix this by unsetting the T3849 timer in the handling of the timer expiry
as the esm_ctxt is not associated with any valid timers anymore. Further
as the timer is a oneshot timer it will be cleaned up after the processing
of the timer callback.

Signed-off-by: Amar Padmanabhan <[email protected]>
rsarwad pushed a commit that referenced this pull request Apr 19, 2021
* Add T3489 tests

Introduce a new test to validate T3489 expiry.

Credit to ulaskozat for the diff

Testing done:
Verified that an ASAN use after free occurs on timer expiry

=7031==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000093460 at pc 0x555807545462 bp 0x7f87093fd2b0 sp 0x7f87093fd2a8
WRITE of size 8 at 0x603000093460 thread T16
    #0 0x555807545461 in nas_stop_T3489 /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/esm_data_context.c:101
    #1 0x5558075c47c5 in esm_proc_esm_information_response /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/esm_information.c:119
    #2 0x55580759339b in esm_recv_information_response /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/sap/esm_recv.c:575
    #3 0x555807551fba in _esm_sap_recv /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/sap/esm_sap.c:679
    #4 0x555807550f33 in esm_sap_send /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/sap/esm_sap.c:283
    #5 0x5558075195a0 in lowerlayer_data_ind /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/emm/LowerLayer.c:276
    #6 0x55580757848f in _emm_as_data_ind /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/emm/sap/emm_as.c:688
    #7 0x555807574ec4 in emm_as_send /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/emm/sap/emm_as.c:180
    #8 0x55580753147f in emm_sap_send /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/emm/sap/emm_sap.c:105
    #9 0x5558074d74fc in nas_proc_ul_transfer_ind /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/nas_proc.c:326
    #10 0x5558071bd634 in handle_message /home/vagrant/magma/lte/gateway/c/oai/tasks/mme_app/mme_app_main.c:97
    #11 0x7f871bb277bd in zloop_start (/usr/lib/x86_64-linux-gnu/libczmq.so.4+0x287bd)
    #12 0x5558071bf169 in mme_app_thread /home/vagrant/magma/lte/gateway/c/oai/tasks/mme_app/mme_app_main.c:447
    #13 0x7f871e11f4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
    #14 0x7f871a494d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)

0x603000093460 is located 0 bytes inside of 32-byte region [0x603000093460,0x603000093480)
freed by thread T16 here:
    #0 0x7f871e602a10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)
    #1 0x5558070dc054 in free_wrapper /home/vagrant/magma/lte/gateway/c/oai/common/dynamic_memory_check.c:47
    #2 0x555807545496 in nas_stop_T3489 /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/esm_data_context.c:103
    #3 0x5558075c517a in _esm_information /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/esm_information.c:269
    #4 0x5558075c4e15 in _esm_information_t3489_handler /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/esm/esm_information.c:199
    #5 0x5558074e2e8a in mme_app_nas_timer_handle_signal_expiry /home/vagrant/magma/lte/gateway/c/oai/tasks/nas/util/nas_timer.c:100
    #6 0x5558071be2d2 in handle_message /home/vagrant/magma/lte/gateway/c/oai/tasks/mme_app/mme_app_main.c:235
    #7 0x7f871bb277bd in zloop_start (/usr/lib/x86_64-linux-gnu/libczmq.so.4+0x287bd)

Signed-off-by: Amar Padmanabhan <[email protected]>

* Invalidate the T3849 timer id while processing esm information retransmit

The _esm_information function stops the existing T3849 timer as referenced
by the esm_ctxt datastructure timer before rescheduling a new T3849 timer
when it requests for the esm info from a UE.
Stopping the timer has a side effect of freeing up the UE related
retransmission data associated with it. This causes issues during
the T3849 timer expiry handling as the cancelled timer and the rescheduled
one reuse the same retransmission data datastructure.

Fix this by unsetting the T3849 timer in the handling of the timer expiry
as the esm_ctxt is not associated with any valid timers anymore. Further
as the timer is a oneshot timer it will be cleaned up after the processing
of the timer callback.

Signed-off-by: Amar Padmanabhan <[email protected]>
rsarwad pushed a commit that referenced this pull request Mar 7, 2022
Addresses one finding (more exist) of magma#11826.

Zero-initialized all instances of `plmn_array[PLMN_BYTES]` (so that they will be null terminated) and enlarged the array by one char to accommodate the null termination.

Fixes the finding:

```
[ RUN      ] TestAMFStateConverter.TestUEm5gmmContextToProto
=================================================================
==15482==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffee811fc86 at pc 0x7f3038dada6d bp 0x7ffee811faa0 sp 0x7ffee811f248
READ of size 7 at 0x7ffee811fc86 thread T0
    #0 0x7f3038dada6c  (/lib/x86_64-linux-gnu/libasan.so.5+0x67a6c)
    #1 0x7f302e641e9b in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(char const*, std::allocator<char> const&) (/lib/x86_64-linux-gnu/libstdc++.so.6+0x145e9b)
    #2 0x7f30383b85f6 in magma::lte::oai::Tai::set_mcc_mnc(char const*) bazel-out/k8-dbg/bin/lte/protos/oai/nas_state_cpp_proto_pb/lte/protos/oai/nas_state.pb.h:11239
```

## Test Plan

Using prototype Bazel build with `--config=asan` validated ASAN finding
is resolved.

Signed-off-by: Scott Moeller <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

9 participants