During the GPRS Attach procedure we might have a foreign tlli and in the RX create a LLME on the fly for this tlli. The GMM GPRS Attach handling code will then assign a new TLLI and keep the foreign tlli as the llme->old_tlli.

When the GMM is sending the identity request the msgb_tlli will point to the foreign tlli. The GPRS LLC code will then try to find that foreign tlli but due the conversion this will not be found. Instead a new ad-hoc LLE/LLME will be created on the fly for each message (this means there are duplicate LLE/LLMEs in the list).

Make the code more strict and remove the tlli_foreign2local change from the look-up routine. This will make the GPRS LLC code find the right LLE/LLME and the N(U) will be handled correctly.

Addresses: <0012> gprs_llc.c:773 LLC RX: unknown TLLI 0xadf11820, creating LLME on the fly ... <0012> gprs_llc.c:357 LLC TX: unknown TLLI 0xedf11820, creating LLME on the fly

Reproducable: Use pcu_emu (gprs attach) and observe with wireshark. --- openbsc/src/gprs/gprs_llc.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/openbsc/src/gprs/gprs_llc.c b/openbsc/src/gprs/gprs_llc.c index 8af5367..57e557a 100644 --- a/openbsc/src/gprs/gprs_llc.c +++ b/openbsc/src/gprs/gprs_llc.c @@ -147,12 +147,10 @@ static inline uint32_t tlli_foreign2local(uint32_t tlli) }

/* lookup LLC Entity based on DLCI (TLLI+SAPI tuple) */ -static struct gprs_llc_lle *lle_by_tlli_sapi(uint32_t tlli, uint8_t sapi) +static struct gprs_llc_lle *lle_by_tlli_sapi(const uint32_t tlli, uint8_t sapi) { struct gprs_llc_llme *llme;

- tlli = tlli_foreign2local(tlli); - llist_for_each_entry(llme, &gprs_llc_llmes, list) { if (llme->tlli == tlli || llme->old_tlli == tlli) return &llme->lle[sapi];