fix: second ue release uecontext without authetication

[donald1218]

No description provided.

[ianchen0119]

Hi @ss920386

Could you please help to review this PR?

Tks.

[linouxis9]

Hi @ianchen0119, @donald1218,

As requested, I have tested this PR with PacketRusher !

This PR seems to help, but a malicious gNodeB is now able to crash the AMF.
It can be reproduced by running the following commands:

• ./packetrusher multi-ue -n 1 --loop --tr 1000
• Wait a few seconds then CTRL-C
• ./packetrusher multi-ue -n 1 --loop --tr 100

amf       | 2024-08-11T20:33:42.778544949Z [FATA][AMF][Ngap] panic: runtime error: invalid memory address or nil pointer dereference
amf       | goroutine 2659 [running]:
amf       | runtime/debug.Stack()
amf       |     /usr/local/go/src/runtime/debug/stack.go:24 +0x5e
amf       | github.com/free5gc/amf/internal/ngap/service.handleConnection.func1()
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/service/service.go:186 +0x45
amf       | panic({0xc7aa00?, 0x145a4f0?})
amf       |     /usr/local/go/src/runtime/panic.go:914 +0x21f
amf       | github.com/free5gc/amf/internal/context.(*RanUe).DetachAmfUe(...)
amf       |     /go/src/free5gc/NFs/amf/internal/context/ran_ue.go:95
amf       | github.com/free5gc/amf/internal/gmm/common.ClearHoldingRanUe(0xc00020a600?)
amf       |     /go/src/free5gc/NFs/amf/internal/gmm/common/user_profile.go:73 +0x12
amf       | github.com/free5gc/amf/internal/nas.HandleNAS(0xc0002c68c0, 0xc00061de60?, {0xc00072adc0, 0x33, 0x40}, 0xa0?)
amf       |     /go/src/free5gc/NFs/amf/internal/nas/handler.go:40 +0x22d
amf       | github.com/free5gc/amf/internal/ngap.handleUplinkNASTransportMain(0xc0002162a0?, 0xc0002c68c0, 0xc000011008?, 0x100?)
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/handler.go:120 +0x65
amf       | github.com/free5gc/amf/internal/ngap.handlerUplinkNASTransport(0xc0009e5580, 0xc0004b4fc0)
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/handler_generated.go:11251 +0x131f
amf       | github.com/free5gc/amf/internal/ngap.dispatchMain(0xc0009e5580, 0x5e?)
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/dispatcher_generated.go:112 +0x2cd
amf       | github.com/free5gc/amf/internal/ngap.Dispatch({0xf0aa30?, 0xc00049db50}, {0xc00091a000, 0x5e, 0x40000})
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/dispatcher.go:49 +0x1ff
amf       | github.com/free5gc/amf/internal/ngap/service.handleConnection(0xc00049db50, 0x40000, {0xe0c2e0?, 0xe0c2f0?, 0xe0c2e8?})
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/service/service.go:239 +0x3e4
amf       | created by github.com/free5gc/amf/internal/ngap/service.listenAndServe in goroutine 26
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/service/service.go:160 +0x997

This won't fix the issue, but for reliability purposes, I would recommend adding some recover() when handling a connection to a gNodeB, as well as when handling messages as well, so a local panic does not make the whole AMF crashes.
You probably need some kind of locking (eg. mutex) on the UE to fix this issue.

If I can be of any help, please reach out !

Thanks and cheers,
Valentin

[donald1218]

Hi @linouxis9 , thank you for helping with the testing. The reason AMF was panicking is that I didn’t check if RanUE was nil before detach. I’ve already fixed this issue.

Tks.