From ff4eab2e516564530060a1c82edf25b51a0f5fdc Mon Sep 17 00:00:00 2001
From: Sukchan Lee <acetcom@gmail.com>
Date: Mon, 6 Mar 2023 21:04:43 +0900
Subject: [PATCH] [SMF] Fixed crash during UPF-HA process (#2115)

---
 src/sgwc/pfcp-sm.c |  4 ++++
 src/sgwu/pfcp-sm.c |  4 ++++
 src/smf/pfcp-sm.c  | 58 +++++++++++++++++++++++++---------------------
 src/upf/pfcp-sm.c  |  4 ++++
 4 files changed, 43 insertions(+), 27 deletions(-)

diff --git a/src/sgwc/pfcp-sm.c b/src/sgwc/pfcp-sm.c
index 66cbf94d8..9d101efa4 100644
--- a/src/sgwc/pfcp-sm.c
+++ b/src/sgwc/pfcp-sm.c
@@ -277,6 +277,10 @@ void sgwc_pfcp_state_associated(ogs_fsm_t *s, sgwc_event_t *e)
         }
         break;
     case SGWC_EVT_SXA_NO_HEARTBEAT:
+
+        /* 'node' context was removed in ogs_pfcp_xact_delete(xact)
+         * So, we should not use PFCP node here */
+
         ogs_warn("No Heartbeat from SGW-U [%s]:%d",
                     OGS_ADDR(addr, buf), OGS_PORT(addr));
         OGS_FSM_TRAN(s, sgwc_pfcp_state_will_associate);
diff --git a/src/sgwu/pfcp-sm.c b/src/sgwu/pfcp-sm.c
index 814981d53..2aa6c9843 100644
--- a/src/sgwu/pfcp-sm.c
+++ b/src/sgwu/pfcp-sm.c
@@ -256,6 +256,10 @@ void sgwu_pfcp_state_associated(ogs_fsm_t *s, sgwu_event_t *e)
         }
         break;
     case SGWU_EVT_SXA_NO_HEARTBEAT:
+
+        /* 'node' context was removed in ogs_pfcp_xact_delete(xact)
+         * So, we should not use PFCP node here */
+
         ogs_warn("No Heartbeat from SGW-C [%s]:%d",
                     OGS_ADDR(addr, buf), OGS_PORT(addr));
         OGS_FSM_TRAN(s, sgwu_pfcp_state_will_associate);
diff --git a/src/smf/pfcp-sm.c b/src/smf/pfcp-sm.c
index 348ef3472..470e861d8 100644
--- a/src/smf/pfcp-sm.c
+++ b/src/smf/pfcp-sm.c
@@ -158,7 +158,6 @@ void smf_pfcp_state_associated(ogs_fsm_t *s, smf_event_t *e)
 
     ogs_sockaddr_t *addr = NULL;
     smf_sess_t *sess = NULL;
-    int r;
 
     ogs_assert(s);
     ogs_assert(e);
@@ -316,31 +315,9 @@ void smf_pfcp_state_associated(ogs_fsm_t *s, smf_event_t *e)
         }
         break;
     case SMF_EVT_N4_NO_HEARTBEAT:
-        node = e->pfcp_node;
-        ogs_assert(node);
 
-        smf_ue_t *smf_ue = NULL, *next = NULL;;
-
-        ogs_list_for_each_safe(&smf_self()->smf_ue_list, next, smf_ue) {
-            smf_sess_t *sess = NULL, *next = NULL;;
-            ogs_assert(smf_ue);
-
-            ogs_list_for_each_safe(&smf_ue->sess_list, next, sess) {
-                ogs_assert(sess);
-
-                if (node == sess->pfcp_node) {
-                    smf_npcf_smpolicycontrol_param_t param;
-
-                    memset(&param, 0, sizeof(param));
-                    r = smf_sbi_discover_and_send(
-                            OGS_SBI_SERVICE_TYPE_NPCF_SMPOLICYCONTROL, NULL,
-                            smf_npcf_smpolicycontrol_build_delete,
-                            sess, NULL, OGS_PFCP_DELETE_TRIGGER_SMF_INITIATED, &param);
-                    ogs_expect(r == OGS_OK);
-                    ogs_assert(r != OGS_ERROR);
-                }
-            }
-        }
+        /* 'node' context was removed in ogs_pfcp_xact_delete(xact)
+         * So, we should not use PFCP node here */
 
         ogs_warn("No Heartbeat from UPF [%s]:%d",
                     OGS_ADDR(addr, buf), OGS_PORT(addr));
@@ -372,17 +349,44 @@ void smf_pfcp_state_exception(ogs_fsm_t *s, smf_event_t *e)
 
 static void node_timeout(ogs_pfcp_xact_t *xact, void *data)
 {
-    int rv;
+    int r, rv;
 
     smf_event_t *e = NULL;
     uint8_t type;
+    ogs_pfcp_node_t *node = NULL;
+    smf_ue_t *smf_ue = NULL, *next_ue = NULL;;
 
     ogs_assert(xact);
     type = xact->seq[0].type;
 
     switch (type) {
     case OGS_PFCP_HEARTBEAT_REQUEST_TYPE:
-        ogs_assert(data);
+        node = data;
+        ogs_assert(node);
+
+        ogs_list_for_each_safe(&smf_self()->smf_ue_list, next_ue, smf_ue) {
+            smf_sess_t *sess = NULL, *next_sess = NULL;;
+            ogs_assert(smf_ue);
+
+            ogs_list_for_each_safe(&smf_ue->sess_list, next_sess, sess) {
+                ogs_assert(sess);
+                ogs_assert(sess->sm_context_ref);
+
+                if (node == sess->pfcp_node) {
+                    smf_npcf_smpolicycontrol_param_t param;
+
+                    ogs_assert(sess->sm_context_ref);
+                    memset(&param, 0, sizeof(param));
+                    r = smf_sbi_discover_and_send(
+                            OGS_SBI_SERVICE_TYPE_NPCF_SMPOLICYCONTROL, NULL,
+                            smf_npcf_smpolicycontrol_build_delete,
+                            sess, NULL, OGS_PFCP_DELETE_TRIGGER_SMF_INITIATED,
+                            &param);
+                    ogs_expect(r == OGS_OK);
+                    ogs_assert(r != OGS_ERROR);
+                }
+            }
+        }
 
         e = smf_event_new(SMF_EVT_N4_NO_HEARTBEAT);
         e->pfcp_node = data;
diff --git a/src/upf/pfcp-sm.c b/src/upf/pfcp-sm.c
index a98dd1557..e850ce3cb 100644
--- a/src/upf/pfcp-sm.c
+++ b/src/upf/pfcp-sm.c
@@ -261,6 +261,10 @@ void upf_pfcp_state_associated(ogs_fsm_t *s, upf_event_t *e)
         }
         break;
     case UPF_EVT_N4_NO_HEARTBEAT:
+
+        /* 'node' context was removed in ogs_pfcp_xact_delete(xact)
+         * So, we should not use PFCP node here */
+
         ogs_warn("No Heartbeat from SMF [%s]:%d",
                     OGS_ADDR(addr, buf), OGS_PORT(addr));
         OGS_FSM_TRAN(s, upf_pfcp_state_will_associate);