sgsn: Add test to verify duplicate DeactPDPCtx crashing osmo-sgsn
osmo-sgsn sends 2 DeletePdpCtxReq on gtp, Confirmation received on first
one frees cbp associatd to pdp and the second one accesses the already
freed cbp.
Related: OS#3956
Change-Id: Ie1cc9fdf91b18b0b7fb3d5fb33b6dcf6f46a393f
diff --git a/sgsn/SGSN_Tests.ttcn b/sgsn/SGSN_Tests.ttcn
index a7cc57f..b146046 100644
--- a/sgsn/SGSN_Tests.ttcn
+++ b/sgsn/SGSN_Tests.ttcn
@@ -1470,6 +1470,56 @@
vc_conn.done;
}
+/* Test MS sending a duplicate Deact PDP Ctx (OS#3956). */
+private function f_TC_attach_pdp_act_deact_dup(charstring id) runs on BSSGP_ConnHdlr {
+ var PdpActPars apars := valueof(t_PdpActPars(mp_ggsn_ip));
+ var Gtp1cUnitdata g_ud;
+ var integer i;
+ var OCT1 cause_regular_deact := '24'O;
+
+ /* first perform regular attach + PDP context act */
+ f_TC_attach(id);
+ f_pdp_ctx_act(apars);
+
+ f_send_l3_gmm_llc(ts_SM_DEACT_PDP_REQ_MO(apars.tid, cause_regular_deact, false, omit), 0);
+ f_send_l3_gmm_llc(ts_SM_DEACT_PDP_REQ_MO(apars.tid, cause_regular_deact, false, omit), 0);
+
+ for (i := 0; i < 2; i := i+1) {
+ GTP.receive(tr_GTPC_MsgType(?, deletePDPContextRequest, apars.ggsn_tei_c)) -> value g_ud {
+ var integer seq_nr := oct2int(g_ud.gtpc.opt_part.sequenceNumber);
+ log("Received deletePDPContextResponse " & int2str(i) & ", seq_nr=" & int2str(seq_nr));
+ GTP.send(ts_GTPC_DeletePdpResp(g_ud.peer, seq_nr, apars.sgsn_tei_c, '7F'O));
+ }
+ }
+
+ alt {
+ [] BSSGP[0].receive(tr_SM_DEACT_PDP_ACCEPT_MT(apars.tid)) {
+ setverdict(pass);
+ }
+ [] as_xid(apars, 0);
+ }
+
+ /* Make sure second DeactPdpAccept is sent: */
+ timer T := 2.0;
+ T.start;
+ alt {
+ [] BSSGP[0].receive(tr_SM_DEACT_PDP_ACCEPT_MT(apars.tid)) {
+ setverdict(fail, "Second SM_DEACT_PDP_ACCEPT_MT received");
+ }
+ [] T.timeout {
+ setverdict(pass);
+ }
+ }
+
+ setverdict(pass);
+}
+testcase TC_attach_pdp_act_deact_dup() runs on test_CT {
+ var BSSGP_ConnHdlr vc_conn;
+ f_init();
+ vc_conn := f_start_handler(refers(f_TC_attach_pdp_act_deact_dup), testcasename(), g_gb, 46);
+ vc_conn.done;
+}
+
/* ATTACH + ATTACH (2nd) */
private function f_TC_attach_forget_tlli_attach(charstring id) runs on BSSGP_ConnHdlr {
g_pars.t_guard := 5.0;
@@ -2545,6 +2595,7 @@
execute( TC_attach_pdp_act_ggsn_reject() );
execute( TC_attach_pdp_act_user_deact_mo() );
execute( TC_attach_pdp_act_user_deact_mt() );
+ execute( TC_attach_pdp_act_deact_dup() );
execute( TC_attach_second_attempt() );
execute( TC_attach_restart_ctr_echo() );
execute( TC_attach_restart_ctr_create() );
diff --git a/sgsn/expected-results.xml b/sgsn/expected-results.xml
index 0b477d1..d9c3706 100644
--- a/sgsn/expected-results.xml
+++ b/sgsn/expected-results.xml
@@ -47,6 +47,7 @@
<testcase classname='SGSN_Tests' name='TC_attach_pdp_act_ggsn_reject' time='MASKED'/>
<testcase classname='SGSN_Tests' name='TC_attach_pdp_act_user_deact_mo' time='MASKED'/>
<testcase classname='SGSN_Tests' name='TC_attach_pdp_act_user_deact_mt' time='MASKED'/>
+ <testcase classname='SGSN_Tests' name='TC_attach_pdp_act_deact_dup' time='MASKED'/>
<testcase classname='SGSN_Tests' name='TC_attach_second_attempt' time='MASKED'>
<failure type='fail-verdict'>Tguard timeout
SGSN_Tests.ttcn:MASKED SGSN_Tests control part