- osmocom-net-gprs - lists.osmocom.org

[PATCH AUTOSEL 4.19 156/158] gtp: fix use-after-free in gtp_encap_destroy()

by Sasha Levin

From: Taehee Yoo <ap420073(a)gmail.com> [ Upstream commit 1788b8569f5de27da09087fa3f6580d2aa04cc75 ] gtp_encap_destroy() is called twice. 1. When interface is deleted. 2. When udp socket is destroyed. either gtp->sk0 or gtp->sk1u could be freed by sock_put() in gtp_encap_destroy(). so, when gtp_encap_destroy() is called again, it would uses freed sk pointer. patch makes gtp_encap_destroy() to set either gtp->sk0 or gtp->sk1u to null. in addition, both gtp->sk0 and gtp->sk1u pointer are protected by rtnl_lock. so, rtnl_lock() is added. Test command: gtp-link add gtp1 & killall gtp-link ip link del gtp1 Splat looks like: [ 83.182767] BUG: KASAN: use-after-free in __lock_acquire+0x3a20/0x46a0 [ 83.184128] Read of size 8 at addr ffff8880cc7d5360 by task ip/1008 [ 83.185567] CPU: 1 PID: 1008 Comm: ip Not tainted 5.2.0-rc6+ #50 [ 83.188469] Call Trace: [ ... ] [ 83.200126] lock_acquire+0x141/0x380 [ 83.200575] ? lock_sock_nested+0x3a/0xf0 [ 83.201069] _raw_spin_lock_bh+0x38/0x70 [ 83.201551] ? lock_sock_nested+0x3a/0xf0 [ 83.202044] lock_sock_nested+0x3a/0xf0 [ 83.202520] gtp_encap_destroy+0x18/0xe0 [gtp] [ 83.203065] gtp_encap_disable.isra.14+0x13/0x50 [gtp] [ 83.203687] gtp_dellink+0x56/0x170 [gtp] [ 83.204190] rtnl_delete_link+0xb4/0x100 [ ... ] [ 83.236513] Allocated by task 976: [ 83.236925] save_stack+0x19/0x80 [ 83.237332] __kasan_kmalloc.constprop.3+0xa0/0xd0 [ 83.237894] kmem_cache_alloc+0xd8/0x280 [ 83.238360] sk_prot_alloc.isra.42+0x50/0x200 [ 83.238874] sk_alloc+0x32/0x940 [ 83.239264] inet_create+0x283/0xc20 [ 83.239684] __sock_create+0x2dd/0x540 [ 83.240136] __sys_socket+0xca/0x1a0 [ 83.240550] __x64_sys_socket+0x6f/0xb0 [ 83.240998] do_syscall_64+0x9c/0x450 [ 83.241466] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 83.242061] [ 83.242249] Freed by task 0: [ 83.242616] save_stack+0x19/0x80 [ 83.243013] __kasan_slab_free+0x111/0x150 [ 83.243498] kmem_cache_free+0x89/0x250 [ 83.244444] __sk_destruct+0x38f/0x5a0 [ 83.245366] rcu_core+0x7e9/0x1c20 [ 83.245766] __do_softirq+0x213/0x8fa Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/gtp.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 6f1ad7ccaea6..61e9b288d2dc 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -289,13 +289,17 @@ static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb) return gtp_rx(pctx, skb, hdrlen, gtp->role); } -static void gtp_encap_destroy(struct sock *sk) +static void __gtp_encap_destroy(struct sock *sk) { struct gtp_dev *gtp; lock_sock(sk); gtp = sk->sk_user_data; if (gtp) { + if (gtp->sk0 == sk) + gtp->sk0 = NULL; + else + gtp->sk1u = NULL; udp_sk(sk)->encap_type = 0; rcu_assign_sk_user_data(sk, NULL); sock_put(sk); @@ -303,12 +307,19 @@ static void gtp_encap_destroy(struct sock *sk) release_sock(sk); } +static void gtp_encap_destroy(struct sock *sk) +{ + rtnl_lock(); + __gtp_encap_destroy(sk); + rtnl_unlock(); +} + static void gtp_encap_disable_sock(struct sock *sk) { if (!sk) return; - gtp_encap_destroy(sk); + __gtp_encap_destroy(sk); } static void gtp_encap_disable(struct gtp_dev *gtp) @@ -1047,6 +1058,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) return -EINVAL; } + rtnl_lock(); rcu_read_lock(); gtp = gtp_find_dev(sock_net(skb->sk), info->attrs); @@ -1071,6 +1083,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) out_unlock: rcu_read_unlock(); + rtnl_unlock(); return err; } -- 2.20.1

4 years, 9 months

1
0
0 0

[PATCH AUTOSEL 4.19 155/158] gtp: fix Illegal context switch in RCU read-side critical section.

by Sasha Levin

From: Taehee Yoo <ap420073(a)gmail.com> [ Upstream commit 3f167e1921865b379a9becf03828e7202c7b4917 ] ipv4_pdp_add() is called in RCU read-side critical section. So GFP_KERNEL should not be used in the function. This patch make ipv4_pdp_add() to use GFP_ATOMIC instead of GFP_KERNEL. Test commands: gtp-link add gtp1 & gtp-tunnel add gtp1 v1 100 200 1.1.1.1 2.2.2.2 Splat looks like: [ 130.618881] ============================= [ 130.626382] WARNING: suspicious RCU usage [ 130.626994] 5.2.0-rc6+ #50 Not tainted [ 130.627622] ----------------------------- [ 130.628223] ./include/linux/rcupdate.h:266 Illegal context switch in RCU read-side critical section! [ 130.629684] [ 130.629684] other info that might help us debug this: [ 130.629684] [ 130.631022] [ 130.631022] rcu_scheduler_active = 2, debug_locks = 1 [ 130.632136] 4 locks held by gtp-tunnel/1025: [ 130.632925] #0: 000000002b93c8b7 (cb_lock){++++}, at: genl_rcv+0x15/0x40 [ 130.634159] #1: 00000000f17bc999 (genl_mutex){+.+.}, at: genl_rcv_msg+0xfb/0x130 [ 130.635487] #2: 00000000c644ed8e (rtnl_mutex){+.+.}, at: gtp_genl_new_pdp+0x18c/0x1150 [gtp] [ 130.636936] #3: 0000000007a1cde7 (rcu_read_lock){....}, at: gtp_genl_new_pdp+0x187/0x1150 [gtp] [ 130.638348] [ 130.638348] stack backtrace: [ 130.639062] CPU: 1 PID: 1025 Comm: gtp-tunnel Not tainted 5.2.0-rc6+ #50 [ 130.641318] Call Trace: [ 130.641707] dump_stack+0x7c/0xbb [ 130.642252] ___might_sleep+0x2c0/0x3b0 [ 130.642862] kmem_cache_alloc_trace+0x1cd/0x2b0 [ 130.643591] gtp_genl_new_pdp+0x6c5/0x1150 [gtp] [ 130.644371] genl_family_rcv_msg+0x63a/0x1030 [ 130.645074] ? mutex_lock_io_nested+0x1090/0x1090 [ 130.645845] ? genl_unregister_family+0x630/0x630 [ 130.646592] ? debug_show_all_locks+0x2d0/0x2d0 [ 130.647293] ? check_flags.part.40+0x440/0x440 [ 130.648099] genl_rcv_msg+0xa3/0x130 [ ... ] Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/gtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index f45a806b6c06..6f1ad7ccaea6 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -958,7 +958,7 @@ static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk, } - pctx = kmalloc(sizeof(struct pdp_ctx), GFP_KERNEL); + pctx = kmalloc(sizeof(*pctx), GFP_ATOMIC); if (pctx == NULL) return -ENOMEM; -- 2.20.1

4 years, 9 months

1
0
0 0

[PATCH AUTOSEL 4.19 154/158] gtp: fix suspicious RCU usage

by Sasha Levin

From: Taehee Yoo <ap420073(a)gmail.com> [ Upstream commit e198987e7dd7d3645a53875151cd6f8fc425b706 ] gtp_encap_enable_socket() and gtp_encap_destroy() are not protected by rcu_read_lock(). and it's not safe to write sk->sk_user_data. This patch make these functions to use lock_sock() instead of rcu_dereference_sk_user_data(). Test commands: gtp-link add gtp1 Splat looks like: [ 83.238315] ============================= [ 83.239127] WARNING: suspicious RCU usage [ 83.239702] 5.2.0-rc6+ #49 Not tainted [ 83.240268] ----------------------------- [ 83.241205] drivers/net/gtp.c:799 suspicious rcu_dereference_check() usage! [ 83.243828] [ 83.243828] other info that might help us debug this: [ 83.243828] [ 83.246325] [ 83.246325] rcu_scheduler_active = 2, debug_locks = 1 [ 83.247314] 1 lock held by gtp-link/1008: [ 83.248523] #0: 0000000017772c7f (rtnl_mutex){+.+.}, at: __rtnl_newlink+0x5f5/0x11b0 [ 83.251503] [ 83.251503] stack backtrace: [ 83.252173] CPU: 0 PID: 1008 Comm: gtp-link Not tainted 5.2.0-rc6+ #49 [ 83.253271] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 83.254562] Call Trace: [ 83.254995] dump_stack+0x7c/0xbb [ 83.255567] gtp_encap_enable_socket+0x2df/0x360 [gtp] [ 83.256415] ? gtp_find_dev+0x1a0/0x1a0 [gtp] [ 83.257161] ? memset+0x1f/0x40 [ 83.257843] gtp_newlink+0x90/0xa21 [gtp] [ 83.258497] ? __netlink_ns_capable+0xc3/0xf0 [ 83.259260] __rtnl_newlink+0xb9f/0x11b0 [ 83.260022] ? rtnl_link_unregister+0x230/0x230 [ ... ] Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/gtp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 83488f2bf7a0..f45a806b6c06 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -293,12 +293,14 @@ static void gtp_encap_destroy(struct sock *sk) { struct gtp_dev *gtp; - gtp = rcu_dereference_sk_user_data(sk); + lock_sock(sk); + gtp = sk->sk_user_data; if (gtp) { udp_sk(sk)->encap_type = 0; rcu_assign_sk_user_data(sk, NULL); sock_put(sk); } + release_sock(sk); } static void gtp_encap_disable_sock(struct sock *sk) @@ -800,7 +802,8 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, goto out_sock; } - if (rcu_dereference_sk_user_data(sock->sk)) { + lock_sock(sock->sk); + if (sock->sk->sk_user_data) { sk = ERR_PTR(-EBUSY); goto out_sock; } @@ -816,6 +819,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg); out_sock: + release_sock(sock->sk); sockfd_put(sock); return sk; } -- 2.20.1

4 years, 9 months

1
0
0 0

[PATCH AUTOSEL 4.19 152/158] gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable()

by Sasha Levin

From: Taehee Yoo <ap420073(a)gmail.com> [ Upstream commit e30155fd23c9c141cbe7d99b786e10a83a328837 ] If an invalid role is sent from user space, gtp_encap_enable() will fail. Then, it should call gtp_encap_disable_sock() but current code doesn't. It makes memory leak. Fixes: 91ed81f9abc7 ("gtp: support SGSN-side tunnels") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/gtp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 7a145172d503..83488f2bf7a0 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -847,8 +847,13 @@ static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]) if (data[IFLA_GTP_ROLE]) { role = nla_get_u32(data[IFLA_GTP_ROLE]); - if (role > GTP_ROLE_SGSN) + if (role > GTP_ROLE_SGSN) { + if (sk0) + gtp_encap_disable_sock(sk0); + if (sk1u) + gtp_encap_disable_sock(sk1u); return -EINVAL; + } } gtp->sk0 = sk0; -- 2.20.1

4 years, 9 months

1
0
0 0

[PATCH AUTOSEL 5.1 217/219] gtp: fix use-after-free in gtp_newlink()

by Sasha Levin

From: Taehee Yoo <ap420073(a)gmail.com> [ Upstream commit a2bed90704c68d3763bf24decb1b781a45395de8 ] Current gtp_newlink() could be called after unregister_pernet_subsys(). gtp_newlink() uses gtp_net but it can be destroyed by unregister_pernet_subsys(). So unregister_pernet_subsys() should be called after rtnl_link_unregister(). Test commands: #SHELL 1 while : do for i in {1..5} do ./gtp-link add gtp$i & done killall gtp-link done #SHELL 2 while : do modprobe -rv gtp done Splat looks like: [ 753.176631] BUG: KASAN: use-after-free in gtp_newlink+0x9b4/0xa5c [gtp] [ 753.177722] Read of size 8 at addr ffff8880d48f2458 by task gtp-link/7126 [ 753.179082] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G W 5.2.0-rc6+ #50 [ 753.185801] Call Trace: [ 753.186264] dump_stack+0x7c/0xbb [ 753.186863] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.187583] print_address_description+0xc7/0x240 [ 753.188382] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.189097] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.189846] __kasan_report+0x12a/0x16f [ 753.190542] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.191298] kasan_report+0xe/0x20 [ 753.191893] gtp_newlink+0x9b4/0xa5c [gtp] [ 753.192580] ? __netlink_ns_capable+0xc3/0xf0 [ 753.193370] __rtnl_newlink+0xb9f/0x11b0 [ ... ] [ 753.241201] Allocated by task 7186: [ 753.241844] save_stack+0x19/0x80 [ 753.242399] __kasan_kmalloc.constprop.3+0xa0/0xd0 [ 753.243192] __kmalloc+0x13e/0x300 [ 753.243764] ops_init+0xd6/0x350 [ 753.244314] register_pernet_operations+0x249/0x6f0 [ ... ] [ 753.251770] Freed by task 7178: [ 753.252288] save_stack+0x19/0x80 [ 753.252833] __kasan_slab_free+0x111/0x150 [ 753.253962] kfree+0xc7/0x280 [ 753.254509] ops_free_list.part.11+0x1c4/0x2d0 [ 753.255241] unregister_pernet_operations+0x262/0x390 [ ... ] [ 753.285883] list_add corruption. next->prev should be prev (ffff8880d48f2458), but was ffff8880d497d878. (next. [ 753.287241] ------------[ cut here ]------------ [ 753.287794] kernel BUG at lib/list_debug.c:25! [ 753.288364] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 753.289099] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G B W 5.2.0-rc6+ #50 [ 753.291036] RIP: 0010:__list_add_valid+0x74/0xd0 [ 753.291589] Code: 48 39 da 75 27 48 39 f5 74 36 48 39 dd 74 31 48 83 c4 08 b8 01 00 00 00 5b 5d c3 48 89 d9 48b [ 753.293779] RSP: 0018:ffff8880cae8f398 EFLAGS: 00010286 [ 753.294401] RAX: 0000000000000075 RBX: ffff8880d497d878 RCX: 0000000000000000 [ 753.296260] RDX: 0000000000000075 RSI: 0000000000000008 RDI: ffffed10195d1e69 [ 753.297070] RBP: ffff8880cd250ae0 R08: ffffed101b4bff21 R09: ffffed101b4bff21 [ 753.297899] R10: 0000000000000001 R11: ffffed101b4bff20 R12: ffff8880d497d878 [ 753.298703] R13: 0000000000000000 R14: ffff8880cd250ae0 R15: ffff8880d48f2458 [ 753.299564] FS: 00007f5f79805740(0000) GS:ffff8880da400000(0000) knlGS:0000000000000000 [ 753.300533] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 753.301231] CR2: 00007fe8c7ef4f10 CR3: 00000000b71a6006 CR4: 00000000000606f0 [ 753.302183] Call Trace: [ 753.302530] gtp_newlink+0x5f6/0xa5c [gtp] [ 753.303037] ? __netlink_ns_capable+0xc3/0xf0 [ 753.303576] __rtnl_newlink+0xb9f/0x11b0 [ 753.304092] ? rtnl_link_unregister+0x230/0x230 Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/gtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 61e9b288d2dc..d178d5bad7e4 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -1385,9 +1385,9 @@ late_initcall(gtp_init); static void __exit gtp_fini(void) { - unregister_pernet_subsys(&gtp_net_ops); genl_unregister_family(&gtp_genl_family); rtnl_link_unregister(&gtp_link_ops); + unregister_pernet_subsys(&gtp_net_ops); pr_info("GTP module unloaded\n"); } -- 2.20.1

4 years, 9 months

1
0
0 0

[PATCH AUTOSEL 5.1 216/219] gtp: fix use-after-free in gtp_encap_destroy()

by Sasha Levin

From: Taehee Yoo <ap420073(a)gmail.com> [ Upstream commit 1788b8569f5de27da09087fa3f6580d2aa04cc75 ] gtp_encap_destroy() is called twice. 1. When interface is deleted. 2. When udp socket is destroyed. either gtp->sk0 or gtp->sk1u could be freed by sock_put() in gtp_encap_destroy(). so, when gtp_encap_destroy() is called again, it would uses freed sk pointer. patch makes gtp_encap_destroy() to set either gtp->sk0 or gtp->sk1u to null. in addition, both gtp->sk0 and gtp->sk1u pointer are protected by rtnl_lock. so, rtnl_lock() is added. Test command: gtp-link add gtp1 & killall gtp-link ip link del gtp1 Splat looks like: [ 83.182767] BUG: KASAN: use-after-free in __lock_acquire+0x3a20/0x46a0 [ 83.184128] Read of size 8 at addr ffff8880cc7d5360 by task ip/1008 [ 83.185567] CPU: 1 PID: 1008 Comm: ip Not tainted 5.2.0-rc6+ #50 [ 83.188469] Call Trace: [ ... ] [ 83.200126] lock_acquire+0x141/0x380 [ 83.200575] ? lock_sock_nested+0x3a/0xf0 [ 83.201069] _raw_spin_lock_bh+0x38/0x70 [ 83.201551] ? lock_sock_nested+0x3a/0xf0 [ 83.202044] lock_sock_nested+0x3a/0xf0 [ 83.202520] gtp_encap_destroy+0x18/0xe0 [gtp] [ 83.203065] gtp_encap_disable.isra.14+0x13/0x50 [gtp] [ 83.203687] gtp_dellink+0x56/0x170 [gtp] [ 83.204190] rtnl_delete_link+0xb4/0x100 [ ... ] [ 83.236513] Allocated by task 976: [ 83.236925] save_stack+0x19/0x80 [ 83.237332] __kasan_kmalloc.constprop.3+0xa0/0xd0 [ 83.237894] kmem_cache_alloc+0xd8/0x280 [ 83.238360] sk_prot_alloc.isra.42+0x50/0x200 [ 83.238874] sk_alloc+0x32/0x940 [ 83.239264] inet_create+0x283/0xc20 [ 83.239684] __sock_create+0x2dd/0x540 [ 83.240136] __sys_socket+0xca/0x1a0 [ 83.240550] __x64_sys_socket+0x6f/0xb0 [ 83.240998] do_syscall_64+0x9c/0x450 [ 83.241466] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 83.242061] [ 83.242249] Freed by task 0: [ 83.242616] save_stack+0x19/0x80 [ 83.243013] __kasan_slab_free+0x111/0x150 [ 83.243498] kmem_cache_free+0x89/0x250 [ 83.244444] __sk_destruct+0x38f/0x5a0 [ 83.245366] rcu_core+0x7e9/0x1c20 [ 83.245766] __do_softirq+0x213/0x8fa Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/gtp.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 6f1ad7ccaea6..61e9b288d2dc 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -289,13 +289,17 @@ static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb) return gtp_rx(pctx, skb, hdrlen, gtp->role); } -static void gtp_encap_destroy(struct sock *sk) +static void __gtp_encap_destroy(struct sock *sk) { struct gtp_dev *gtp; lock_sock(sk); gtp = sk->sk_user_data; if (gtp) { + if (gtp->sk0 == sk) + gtp->sk0 = NULL; + else + gtp->sk1u = NULL; udp_sk(sk)->encap_type = 0; rcu_assign_sk_user_data(sk, NULL); sock_put(sk); @@ -303,12 +307,19 @@ static void gtp_encap_destroy(struct sock *sk) release_sock(sk); } +static void gtp_encap_destroy(struct sock *sk) +{ + rtnl_lock(); + __gtp_encap_destroy(sk); + rtnl_unlock(); +} + static void gtp_encap_disable_sock(struct sock *sk) { if (!sk) return; - gtp_encap_destroy(sk); + __gtp_encap_destroy(sk); } static void gtp_encap_disable(struct gtp_dev *gtp) @@ -1047,6 +1058,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) return -EINVAL; } + rtnl_lock(); rcu_read_lock(); gtp = gtp_find_dev(sock_net(skb->sk), info->attrs); @@ -1071,6 +1083,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) out_unlock: rcu_read_unlock(); + rtnl_unlock(); return err; } -- 2.20.1

4 years, 9 months

1
0
0 0

[PATCH AUTOSEL 5.1 215/219] gtp: fix Illegal context switch in RCU read-side critical section.

by Sasha Levin

From: Taehee Yoo <ap420073(a)gmail.com> [ Upstream commit 3f167e1921865b379a9becf03828e7202c7b4917 ] ipv4_pdp_add() is called in RCU read-side critical section. So GFP_KERNEL should not be used in the function. This patch make ipv4_pdp_add() to use GFP_ATOMIC instead of GFP_KERNEL. Test commands: gtp-link add gtp1 & gtp-tunnel add gtp1 v1 100 200 1.1.1.1 2.2.2.2 Splat looks like: [ 130.618881] ============================= [ 130.626382] WARNING: suspicious RCU usage [ 130.626994] 5.2.0-rc6+ #50 Not tainted [ 130.627622] ----------------------------- [ 130.628223] ./include/linux/rcupdate.h:266 Illegal context switch in RCU read-side critical section! [ 130.629684] [ 130.629684] other info that might help us debug this: [ 130.629684] [ 130.631022] [ 130.631022] rcu_scheduler_active = 2, debug_locks = 1 [ 130.632136] 4 locks held by gtp-tunnel/1025: [ 130.632925] #0: 000000002b93c8b7 (cb_lock){++++}, at: genl_rcv+0x15/0x40 [ 130.634159] #1: 00000000f17bc999 (genl_mutex){+.+.}, at: genl_rcv_msg+0xfb/0x130 [ 130.635487] #2: 00000000c644ed8e (rtnl_mutex){+.+.}, at: gtp_genl_new_pdp+0x18c/0x1150 [gtp] [ 130.636936] #3: 0000000007a1cde7 (rcu_read_lock){....}, at: gtp_genl_new_pdp+0x187/0x1150 [gtp] [ 130.638348] [ 130.638348] stack backtrace: [ 130.639062] CPU: 1 PID: 1025 Comm: gtp-tunnel Not tainted 5.2.0-rc6+ #50 [ 130.641318] Call Trace: [ 130.641707] dump_stack+0x7c/0xbb [ 130.642252] ___might_sleep+0x2c0/0x3b0 [ 130.642862] kmem_cache_alloc_trace+0x1cd/0x2b0 [ 130.643591] gtp_genl_new_pdp+0x6c5/0x1150 [gtp] [ 130.644371] genl_family_rcv_msg+0x63a/0x1030 [ 130.645074] ? mutex_lock_io_nested+0x1090/0x1090 [ 130.645845] ? genl_unregister_family+0x630/0x630 [ 130.646592] ? debug_show_all_locks+0x2d0/0x2d0 [ 130.647293] ? check_flags.part.40+0x440/0x440 [ 130.648099] genl_rcv_msg+0xa3/0x130 [ ... ] Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/gtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index f45a806b6c06..6f1ad7ccaea6 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -958,7 +958,7 @@ static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk, } - pctx = kmalloc(sizeof(struct pdp_ctx), GFP_KERNEL); + pctx = kmalloc(sizeof(*pctx), GFP_ATOMIC); if (pctx == NULL) return -ENOMEM; -- 2.20.1

4 years, 9 months

1
0
0 0

[PATCH AUTOSEL 5.1 214/219] gtp: fix suspicious RCU usage

by Sasha Levin

From: Taehee Yoo <ap420073(a)gmail.com> [ Upstream commit e198987e7dd7d3645a53875151cd6f8fc425b706 ] gtp_encap_enable_socket() and gtp_encap_destroy() are not protected by rcu_read_lock(). and it's not safe to write sk->sk_user_data. This patch make these functions to use lock_sock() instead of rcu_dereference_sk_user_data(). Test commands: gtp-link add gtp1 Splat looks like: [ 83.238315] ============================= [ 83.239127] WARNING: suspicious RCU usage [ 83.239702] 5.2.0-rc6+ #49 Not tainted [ 83.240268] ----------------------------- [ 83.241205] drivers/net/gtp.c:799 suspicious rcu_dereference_check() usage! [ 83.243828] [ 83.243828] other info that might help us debug this: [ 83.243828] [ 83.246325] [ 83.246325] rcu_scheduler_active = 2, debug_locks = 1 [ 83.247314] 1 lock held by gtp-link/1008: [ 83.248523] #0: 0000000017772c7f (rtnl_mutex){+.+.}, at: __rtnl_newlink+0x5f5/0x11b0 [ 83.251503] [ 83.251503] stack backtrace: [ 83.252173] CPU: 0 PID: 1008 Comm: gtp-link Not tainted 5.2.0-rc6+ #49 [ 83.253271] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 83.254562] Call Trace: [ 83.254995] dump_stack+0x7c/0xbb [ 83.255567] gtp_encap_enable_socket+0x2df/0x360 [gtp] [ 83.256415] ? gtp_find_dev+0x1a0/0x1a0 [gtp] [ 83.257161] ? memset+0x1f/0x40 [ 83.257843] gtp_newlink+0x90/0xa21 [gtp] [ 83.258497] ? __netlink_ns_capable+0xc3/0xf0 [ 83.259260] __rtnl_newlink+0xb9f/0x11b0 [ 83.260022] ? rtnl_link_unregister+0x230/0x230 [ ... ] Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/gtp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 83488f2bf7a0..f45a806b6c06 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -293,12 +293,14 @@ static void gtp_encap_destroy(struct sock *sk) { struct gtp_dev *gtp; - gtp = rcu_dereference_sk_user_data(sk); + lock_sock(sk); + gtp = sk->sk_user_data; if (gtp) { udp_sk(sk)->encap_type = 0; rcu_assign_sk_user_data(sk, NULL); sock_put(sk); } + release_sock(sk); } static void gtp_encap_disable_sock(struct sock *sk) @@ -800,7 +802,8 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, goto out_sock; } - if (rcu_dereference_sk_user_data(sock->sk)) { + lock_sock(sock->sk); + if (sock->sk->sk_user_data) { sk = ERR_PTR(-EBUSY); goto out_sock; } @@ -816,6 +819,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg); out_sock: + release_sock(sock->sk); sockfd_put(sock); return sk; } -- 2.20.1

4 years, 9 months

1
0
0 0

[PATCH AUTOSEL 5.1 212/219] gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable()

by Sasha Levin

From: Taehee Yoo <ap420073(a)gmail.com> [ Upstream commit e30155fd23c9c141cbe7d99b786e10a83a328837 ] If an invalid role is sent from user space, gtp_encap_enable() will fail. Then, it should call gtp_encap_disable_sock() but current code doesn't. It makes memory leak. Fixes: 91ed81f9abc7 ("gtp: support SGSN-side tunnels") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/gtp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 7a145172d503..83488f2bf7a0 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -847,8 +847,13 @@ static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]) if (data[IFLA_GTP_ROLE]) { role = nla_get_u32(data[IFLA_GTP_ROLE]); - if (role > GTP_ROLE_SGSN) + if (role > GTP_ROLE_SGSN) { + if (sk0) + gtp_encap_disable_sock(sk0); + if (sk1u) + gtp_encap_disable_sock(sk1u); return -EINVAL; + } } gtp->sk0 = sk0; -- 2.20.1

4 years, 9 months

1
0
0 0

[PATCH AUTOSEL 5.2 247/249] gtp: fix use-after-free in gtp_newlink()

by Sasha Levin

From: Taehee Yoo <ap420073(a)gmail.com> [ Upstream commit a2bed90704c68d3763bf24decb1b781a45395de8 ] Current gtp_newlink() could be called after unregister_pernet_subsys(). gtp_newlink() uses gtp_net but it can be destroyed by unregister_pernet_subsys(). So unregister_pernet_subsys() should be called after rtnl_link_unregister(). Test commands: #SHELL 1 while : do for i in {1..5} do ./gtp-link add gtp$i & done killall gtp-link done #SHELL 2 while : do modprobe -rv gtp done Splat looks like: [ 753.176631] BUG: KASAN: use-after-free in gtp_newlink+0x9b4/0xa5c [gtp] [ 753.177722] Read of size 8 at addr ffff8880d48f2458 by task gtp-link/7126 [ 753.179082] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G W 5.2.0-rc6+ #50 [ 753.185801] Call Trace: [ 753.186264] dump_stack+0x7c/0xbb [ 753.186863] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.187583] print_address_description+0xc7/0x240 [ 753.188382] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.189097] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.189846] __kasan_report+0x12a/0x16f [ 753.190542] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.191298] kasan_report+0xe/0x20 [ 753.191893] gtp_newlink+0x9b4/0xa5c [gtp] [ 753.192580] ? __netlink_ns_capable+0xc3/0xf0 [ 753.193370] __rtnl_newlink+0xb9f/0x11b0 [ ... ] [ 753.241201] Allocated by task 7186: [ 753.241844] save_stack+0x19/0x80 [ 753.242399] __kasan_kmalloc.constprop.3+0xa0/0xd0 [ 753.243192] __kmalloc+0x13e/0x300 [ 753.243764] ops_init+0xd6/0x350 [ 753.244314] register_pernet_operations+0x249/0x6f0 [ ... ] [ 753.251770] Freed by task 7178: [ 753.252288] save_stack+0x19/0x80 [ 753.252833] __kasan_slab_free+0x111/0x150 [ 753.253962] kfree+0xc7/0x280 [ 753.254509] ops_free_list.part.11+0x1c4/0x2d0 [ 753.255241] unregister_pernet_operations+0x262/0x390 [ ... ] [ 753.285883] list_add corruption. next->prev should be prev (ffff8880d48f2458), but was ffff8880d497d878. (next. [ 753.287241] ------------[ cut here ]------------ [ 753.287794] kernel BUG at lib/list_debug.c:25! [ 753.288364] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 753.289099] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G B W 5.2.0-rc6+ #50 [ 753.291036] RIP: 0010:__list_add_valid+0x74/0xd0 [ 753.291589] Code: 48 39 da 75 27 48 39 f5 74 36 48 39 dd 74 31 48 83 c4 08 b8 01 00 00 00 5b 5d c3 48 89 d9 48b [ 753.293779] RSP: 0018:ffff8880cae8f398 EFLAGS: 00010286 [ 753.294401] RAX: 0000000000000075 RBX: ffff8880d497d878 RCX: 0000000000000000 [ 753.296260] RDX: 0000000000000075 RSI: 0000000000000008 RDI: ffffed10195d1e69 [ 753.297070] RBP: ffff8880cd250ae0 R08: ffffed101b4bff21 R09: ffffed101b4bff21 [ 753.297899] R10: 0000000000000001 R11: ffffed101b4bff20 R12: ffff8880d497d878 [ 753.298703] R13: 0000000000000000 R14: ffff8880cd250ae0 R15: ffff8880d48f2458 [ 753.299564] FS: 00007f5f79805740(0000) GS:ffff8880da400000(0000) knlGS:0000000000000000 [ 753.300533] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 753.301231] CR2: 00007fe8c7ef4f10 CR3: 00000000b71a6006 CR4: 00000000000606f0 [ 753.302183] Call Trace: [ 753.302530] gtp_newlink+0x5f6/0xa5c [gtp] [ 753.303037] ? __netlink_ns_capable+0xc3/0xf0 [ 753.303576] __rtnl_newlink+0xb9f/0x11b0 [ 753.304092] ? rtnl_link_unregister+0x230/0x230 Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/gtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 5615cdb7202c..607f38712b4e 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -1382,9 +1382,9 @@ late_initcall(gtp_init); static void __exit gtp_fini(void) { - unregister_pernet_subsys(&gtp_net_ops); genl_unregister_family(&gtp_genl_family); rtnl_link_unregister(&gtp_link_ops); + unregister_pernet_subsys(&gtp_net_ops); pr_info("GTP module unloaded\n"); } -- 2.20.1

4 years, 9 months

1
0
0 0

[PATCH AUTOSEL 5.2 246/249] gtp: fix use-after-free in gtp_encap_destroy()

by Sasha Levin

From: Taehee Yoo <ap420073(a)gmail.com> [ Upstream commit 1788b8569f5de27da09087fa3f6580d2aa04cc75 ] gtp_encap_destroy() is called twice. 1. When interface is deleted. 2. When udp socket is destroyed. either gtp->sk0 or gtp->sk1u could be freed by sock_put() in gtp_encap_destroy(). so, when gtp_encap_destroy() is called again, it would uses freed sk pointer. patch makes gtp_encap_destroy() to set either gtp->sk0 or gtp->sk1u to null. in addition, both gtp->sk0 and gtp->sk1u pointer are protected by rtnl_lock. so, rtnl_lock() is added. Test command: gtp-link add gtp1 & killall gtp-link ip link del gtp1 Splat looks like: [ 83.182767] BUG: KASAN: use-after-free in __lock_acquire+0x3a20/0x46a0 [ 83.184128] Read of size 8 at addr ffff8880cc7d5360 by task ip/1008 [ 83.185567] CPU: 1 PID: 1008 Comm: ip Not tainted 5.2.0-rc6+ #50 [ 83.188469] Call Trace: [ ... ] [ 83.200126] lock_acquire+0x141/0x380 [ 83.200575] ? lock_sock_nested+0x3a/0xf0 [ 83.201069] _raw_spin_lock_bh+0x38/0x70 [ 83.201551] ? lock_sock_nested+0x3a/0xf0 [ 83.202044] lock_sock_nested+0x3a/0xf0 [ 83.202520] gtp_encap_destroy+0x18/0xe0 [gtp] [ 83.203065] gtp_encap_disable.isra.14+0x13/0x50 [gtp] [ 83.203687] gtp_dellink+0x56/0x170 [gtp] [ 83.204190] rtnl_delete_link+0xb4/0x100 [ ... ] [ 83.236513] Allocated by task 976: [ 83.236925] save_stack+0x19/0x80 [ 83.237332] __kasan_kmalloc.constprop.3+0xa0/0xd0 [ 83.237894] kmem_cache_alloc+0xd8/0x280 [ 83.238360] sk_prot_alloc.isra.42+0x50/0x200 [ 83.238874] sk_alloc+0x32/0x940 [ 83.239264] inet_create+0x283/0xc20 [ 83.239684] __sock_create+0x2dd/0x540 [ 83.240136] __sys_socket+0xca/0x1a0 [ 83.240550] __x64_sys_socket+0x6f/0xb0 [ 83.240998] do_syscall_64+0x9c/0x450 [ 83.241466] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 83.242061] [ 83.242249] Freed by task 0: [ 83.242616] save_stack+0x19/0x80 [ 83.243013] __kasan_slab_free+0x111/0x150 [ 83.243498] kmem_cache_free+0x89/0x250 [ 83.244444] __sk_destruct+0x38f/0x5a0 [ 83.245366] rcu_core+0x7e9/0x1c20 [ 83.245766] __do_softirq+0x213/0x8fa Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/gtp.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index b770335c03c1..5615cdb7202c 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -285,13 +285,17 @@ static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb) return gtp_rx(pctx, skb, hdrlen, gtp->role); } -static void gtp_encap_destroy(struct sock *sk) +static void __gtp_encap_destroy(struct sock *sk) { struct gtp_dev *gtp; lock_sock(sk); gtp = sk->sk_user_data; if (gtp) { + if (gtp->sk0 == sk) + gtp->sk0 = NULL; + else + gtp->sk1u = NULL; udp_sk(sk)->encap_type = 0; rcu_assign_sk_user_data(sk, NULL); sock_put(sk); @@ -299,12 +303,19 @@ static void gtp_encap_destroy(struct sock *sk) release_sock(sk); } +static void gtp_encap_destroy(struct sock *sk) +{ + rtnl_lock(); + __gtp_encap_destroy(sk); + rtnl_unlock(); +} + static void gtp_encap_disable_sock(struct sock *sk) { if (!sk) return; - gtp_encap_destroy(sk); + __gtp_encap_destroy(sk); } static void gtp_encap_disable(struct gtp_dev *gtp) @@ -1043,6 +1054,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) return -EINVAL; } + rtnl_lock(); rcu_read_lock(); gtp = gtp_find_dev(sock_net(skb->sk), info->attrs); @@ -1067,6 +1079,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) out_unlock: rcu_read_unlock(); + rtnl_unlock(); return err; } -- 2.20.1

4 years, 9 months

1
0
0 0

[PATCH AUTOSEL 5.2 245/249] gtp: fix Illegal context switch in RCU read-side critical section.

by Sasha Levin

From: Taehee Yoo <ap420073(a)gmail.com> [ Upstream commit 3f167e1921865b379a9becf03828e7202c7b4917 ] ipv4_pdp_add() is called in RCU read-side critical section. So GFP_KERNEL should not be used in the function. This patch make ipv4_pdp_add() to use GFP_ATOMIC instead of GFP_KERNEL. Test commands: gtp-link add gtp1 & gtp-tunnel add gtp1 v1 100 200 1.1.1.1 2.2.2.2 Splat looks like: [ 130.618881] ============================= [ 130.626382] WARNING: suspicious RCU usage [ 130.626994] 5.2.0-rc6+ #50 Not tainted [ 130.627622] ----------------------------- [ 130.628223] ./include/linux/rcupdate.h:266 Illegal context switch in RCU read-side critical section! [ 130.629684] [ 130.629684] other info that might help us debug this: [ 130.629684] [ 130.631022] [ 130.631022] rcu_scheduler_active = 2, debug_locks = 1 [ 130.632136] 4 locks held by gtp-tunnel/1025: [ 130.632925] #0: 000000002b93c8b7 (cb_lock){++++}, at: genl_rcv+0x15/0x40 [ 130.634159] #1: 00000000f17bc999 (genl_mutex){+.+.}, at: genl_rcv_msg+0xfb/0x130 [ 130.635487] #2: 00000000c644ed8e (rtnl_mutex){+.+.}, at: gtp_genl_new_pdp+0x18c/0x1150 [gtp] [ 130.636936] #3: 0000000007a1cde7 (rcu_read_lock){....}, at: gtp_genl_new_pdp+0x187/0x1150 [gtp] [ 130.638348] [ 130.638348] stack backtrace: [ 130.639062] CPU: 1 PID: 1025 Comm: gtp-tunnel Not tainted 5.2.0-rc6+ #50 [ 130.641318] Call Trace: [ 130.641707] dump_stack+0x7c/0xbb [ 130.642252] ___might_sleep+0x2c0/0x3b0 [ 130.642862] kmem_cache_alloc_trace+0x1cd/0x2b0 [ 130.643591] gtp_genl_new_pdp+0x6c5/0x1150 [gtp] [ 130.644371] genl_family_rcv_msg+0x63a/0x1030 [ 130.645074] ? mutex_lock_io_nested+0x1090/0x1090 [ 130.645845] ? genl_unregister_family+0x630/0x630 [ 130.646592] ? debug_show_all_locks+0x2d0/0x2d0 [ 130.647293] ? check_flags.part.40+0x440/0x440 [ 130.648099] genl_rcv_msg+0xa3/0x130 [ ... ] Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/gtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 61f19e66be55..b770335c03c1 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -954,7 +954,7 @@ static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk, } - pctx = kmalloc(sizeof(struct pdp_ctx), GFP_KERNEL); + pctx = kmalloc(sizeof(*pctx), GFP_ATOMIC); if (pctx == NULL) return -ENOMEM; -- 2.20.1

4 years, 9 months

1
0
0 0

[PATCH AUTOSEL 5.2 244/249] gtp: fix suspicious RCU usage

by Sasha Levin

From: Taehee Yoo <ap420073(a)gmail.com> [ Upstream commit e198987e7dd7d3645a53875151cd6f8fc425b706 ] gtp_encap_enable_socket() and gtp_encap_destroy() are not protected by rcu_read_lock(). and it's not safe to write sk->sk_user_data. This patch make these functions to use lock_sock() instead of rcu_dereference_sk_user_data(). Test commands: gtp-link add gtp1 Splat looks like: [ 83.238315] ============================= [ 83.239127] WARNING: suspicious RCU usage [ 83.239702] 5.2.0-rc6+ #49 Not tainted [ 83.240268] ----------------------------- [ 83.241205] drivers/net/gtp.c:799 suspicious rcu_dereference_check() usage! [ 83.243828] [ 83.243828] other info that might help us debug this: [ 83.243828] [ 83.246325] [ 83.246325] rcu_scheduler_active = 2, debug_locks = 1 [ 83.247314] 1 lock held by gtp-link/1008: [ 83.248523] #0: 0000000017772c7f (rtnl_mutex){+.+.}, at: __rtnl_newlink+0x5f5/0x11b0 [ 83.251503] [ 83.251503] stack backtrace: [ 83.252173] CPU: 0 PID: 1008 Comm: gtp-link Not tainted 5.2.0-rc6+ #49 [ 83.253271] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 83.254562] Call Trace: [ 83.254995] dump_stack+0x7c/0xbb [ 83.255567] gtp_encap_enable_socket+0x2df/0x360 [gtp] [ 83.256415] ? gtp_find_dev+0x1a0/0x1a0 [gtp] [ 83.257161] ? memset+0x1f/0x40 [ 83.257843] gtp_newlink+0x90/0xa21 [gtp] [ 83.258497] ? __netlink_ns_capable+0xc3/0xf0 [ 83.259260] __rtnl_newlink+0xb9f/0x11b0 [ 83.260022] ? rtnl_link_unregister+0x230/0x230 [ ... ] Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/gtp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 01fc51892e48..61f19e66be55 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -289,12 +289,14 @@ static void gtp_encap_destroy(struct sock *sk) { struct gtp_dev *gtp; - gtp = rcu_dereference_sk_user_data(sk); + lock_sock(sk); + gtp = sk->sk_user_data; if (gtp) { udp_sk(sk)->encap_type = 0; rcu_assign_sk_user_data(sk, NULL); sock_put(sk); } + release_sock(sk); } static void gtp_encap_disable_sock(struct sock *sk) @@ -796,7 +798,8 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, goto out_sock; } - if (rcu_dereference_sk_user_data(sock->sk)) { + lock_sock(sock->sk); + if (sock->sk->sk_user_data) { sk = ERR_PTR(-EBUSY); goto out_sock; } @@ -812,6 +815,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg); out_sock: + release_sock(sock->sk); sockfd_put(sock); return sk; } -- 2.20.1

4 years, 9 months

1
0
0 0

[PATCH AUTOSEL 5.2 242/249] gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable()

by Sasha Levin

From: Taehee Yoo <ap420073(a)gmail.com> [ Upstream commit e30155fd23c9c141cbe7d99b786e10a83a328837 ] If an invalid role is sent from user space, gtp_encap_enable() will fail. Then, it should call gtp_encap_disable_sock() but current code doesn't. It makes memory leak. Fixes: 91ed81f9abc7 ("gtp: support SGSN-side tunnels") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/gtp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index fc45b749db46..01fc51892e48 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -843,8 +843,13 @@ static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]) if (data[IFLA_GTP_ROLE]) { role = nla_get_u32(data[IFLA_GTP_ROLE]); - if (role > GTP_ROLE_SGSN) + if (role > GTP_ROLE_SGSN) { + if (sk0) + gtp_encap_disable_sock(sk0); + if (sk1u) + gtp_encap_disable_sock(sk1u); return -EINVAL; + } } gtp->sk0 = sk0; -- 2.20.1

4 years, 9 months

1
0
0 0

[PATCH net 0/6] gtp: fix several bugs

by Taehee Yoo

This patch series fixes several bugs in the gtp module. First patch fixes suspicious RCU usage. The problem is to use rcu_dereference_sk_user_data() outside of RCU read critical section. Second patch fixes use-after-free. gtp_encap_destroy() is called twice. gtp_encap_destroy() use both gtp->sk0 and gtp->sk1u. these pointers can be freed in gtp_encap_destroy(). So, gtp_encap_destroy() should avoid using freed sk pointer. Third patch removes duplicate code in gtp_dellink(). gtp_dellink() calls gtp_encap_disable() twice. So, remove one of them. Fourth patch fixes usage of GFP_KERNEL. GFP_KERNEL can not be used in RCU read critical section. This patch make ipv4_pdp_add() to use GFP_ATOMIC instead of GFP_KERNEL. Fifth patch fixes use-after-free in gtp_newlink(). gtp_newlink() uses gtp_net which would be destroyed by the __exit_net routine. So, gtp_newlink should not be called after the __exit_net routine. Sixth patch adds missing error handling routine in gtp_encap_enable(). gtp_encap_enable() will fail, if invalid role value is sent from user-space. if so, gtp_encap_enable() should execute error handling routine. Taehee Yoo (6): gtp: fix suspicious RCU usage gtp: fix use-after-free in gtp_encap_destroy() gtp: remove duplicate code in gtp_dellink() gtp: fix Illegal context switch in RCU read-side critical section. gtp: fix use-after-free in gtp_newlink() gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable() drivers/net/gtp.c | 37 +++++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 8 deletions(-) -- 2.17.1

4 years, 10 months

3
3
0 0

[PATCH net 6/6] gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable()

by Taehee Yoo

If an invalid role is sent from user space, gtp_encap_enable() will fail. Then, it should call gtp_encap_disable_sock() but current code doesn't. It makes memory leak. Fixes: 91ed81f9abc7 ("gtp: support SGSN-side tunnels") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> --- drivers/net/gtp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index b3ccac54e204..ecfe26215935 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -857,8 +857,13 @@ static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]) if (data[IFLA_GTP_ROLE]) { role = nla_get_u32(data[IFLA_GTP_ROLE]); - if (role > GTP_ROLE_SGSN) + if (role > GTP_ROLE_SGSN) { + if (sk0) + gtp_encap_disable_sock(sk0); + if (sk1u) + gtp_encap_disable_sock(sk1u); return -EINVAL; + } } gtp->sk0 = sk0; -- 2.17.1

4 years, 10 months

1
0
0 0

[PATCH net 5/6] gtp: fix use-after-free in gtp_newlink()

by Taehee Yoo

Current gtp_newlink() could be called after unregister_pernet_subsys(). gtp_newlink() uses gtp_net but it can be destroyed by unregister_pernet_subsys(). So unregister_pernet_subsys() should be called after rtnl_link_unregister(). Test commands: #SHELL 1 while : do for i in {1..5} do ./gtp-link add gtp$i & done killall gtp-link done #SHELL 2 while : do modprobe -rv gtp done Splat looks like: [ 753.176631] BUG: KASAN: use-after-free in gtp_newlink+0x9b4/0xa5c [gtp] [ 753.177722] Read of size 8 at addr ffff8880d48f2458 by task gtp-link/7126 [ 753.179082] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G W 5.2.0-rc6+ #50 [ 753.185801] Call Trace: [ 753.186264] dump_stack+0x7c/0xbb [ 753.186863] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.187583] print_address_description+0xc7/0x240 [ 753.188382] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.189097] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.189846] __kasan_report+0x12a/0x16f [ 753.190542] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.191298] kasan_report+0xe/0x20 [ 753.191893] gtp_newlink+0x9b4/0xa5c [gtp] [ 753.192580] ? __netlink_ns_capable+0xc3/0xf0 [ 753.193370] __rtnl_newlink+0xb9f/0x11b0 [ ... ] [ 753.241201] Allocated by task 7186: [ 753.241844] save_stack+0x19/0x80 [ 753.242399] __kasan_kmalloc.constprop.3+0xa0/0xd0 [ 753.243192] __kmalloc+0x13e/0x300 [ 753.243764] ops_init+0xd6/0x350 [ 753.244314] register_pernet_operations+0x249/0x6f0 [ ... ] [ 753.251770] Freed by task 7178: [ 753.252288] save_stack+0x19/0x80 [ 753.252833] __kasan_slab_free+0x111/0x150 [ 753.253962] kfree+0xc7/0x280 [ 753.254509] ops_free_list.part.11+0x1c4/0x2d0 [ 753.255241] unregister_pernet_operations+0x262/0x390 [ ... ] [ 753.285883] list_add corruption. next->prev should be prev (ffff8880d48f2458), but was ffff8880d497d878. (next. [ 753.287241] ------------[ cut here ]------------ [ 753.287794] kernel BUG at lib/list_debug.c:25! [ 753.288364] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 753.289099] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G B W 5.2.0-rc6+ #50 [ 753.291036] RIP: 0010:__list_add_valid+0x74/0xd0 [ 753.291589] Code: 48 39 da 75 27 48 39 f5 74 36 48 39 dd 74 31 48 83 c4 08 b8 01 00 00 00 5b 5d c3 48 89 d9 48b [ 753.293779] RSP: 0018:ffff8880cae8f398 EFLAGS: 00010286 [ 753.294401] RAX: 0000000000000075 RBX: ffff8880d497d878 RCX: 0000000000000000 [ 753.296260] RDX: 0000000000000075 RSI: 0000000000000008 RDI: ffffed10195d1e69 [ 753.297070] RBP: ffff8880cd250ae0 R08: ffffed101b4bff21 R09: ffffed101b4bff21 [ 753.297899] R10: 0000000000000001 R11: ffffed101b4bff20 R12: ffff8880d497d878 [ 753.298703] R13: 0000000000000000 R14: ffff8880cd250ae0 R15: ffff8880d48f2458 [ 753.299564] FS: 00007f5f79805740(0000) GS:ffff8880da400000(0000) knlGS:0000000000000000 [ 753.300533] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 753.301231] CR2: 00007fe8c7ef4f10 CR3: 00000000b71a6006 CR4: 00000000000606f0 [ 753.302183] Call Trace: [ 753.302530] gtp_newlink+0x5f6/0xa5c [gtp] [ 753.303037] ? __netlink_ns_capable+0xc3/0xf0 [ 753.303576] __rtnl_newlink+0xb9f/0x11b0 [ 753.304092] ? rtnl_link_unregister+0x230/0x230 Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> --- drivers/net/gtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 52f35cbeb1dc..b3ccac54e204 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -1376,9 +1376,9 @@ late_initcall(gtp_init); static void __exit gtp_fini(void) { - unregister_pernet_subsys(&gtp_net_ops); genl_unregister_family(&gtp_genl_family); rtnl_link_unregister(&gtp_link_ops); + unregister_pernet_subsys(&gtp_net_ops); pr_info("GTP module unloaded\n"); } -- 2.17.1

4 years, 10 months

1
0
0 0

[PATCH net 4/6] gtp: fix Illegal context switch in RCU read-side critical section.

by Taehee Yoo

ipv4_pdp_add() is called in RCU read-side critical section. So GFP_KERNEL should not be used in the function. This patch make ipv4_pdp_add() to use GFP_ATOMIC instead of GFP_KERNEL. Test commands: gtp-link add gtp1 & gtp-tunnel add gtp1 v1 100 200 1.1.1.1 2.2.2.2 Splat looks like: [ 130.618881] ============================= [ 130.626382] WARNING: suspicious RCU usage [ 130.626994] 5.2.0-rc6+ #50 Not tainted [ 130.627622] ----------------------------- [ 130.628223] ./include/linux/rcupdate.h:266 Illegal context switch in RCU read-side critical section! [ 130.629684] [ 130.629684] other info that might help us debug this: [ 130.629684] [ 130.631022] [ 130.631022] rcu_scheduler_active = 2, debug_locks = 1 [ 130.632136] 4 locks held by gtp-tunnel/1025: [ 130.632925] #0: 000000002b93c8b7 (cb_lock){++++}, at: genl_rcv+0x15/0x40 [ 130.634159] #1: 00000000f17bc999 (genl_mutex){+.+.}, at: genl_rcv_msg+0xfb/0x130 [ 130.635487] #2: 00000000c644ed8e (rtnl_mutex){+.+.}, at: gtp_genl_new_pdp+0x18c/0x1150 [gtp] [ 130.636936] #3: 0000000007a1cde7 (rcu_read_lock){....}, at: gtp_genl_new_pdp+0x187/0x1150 [gtp] [ 130.638348] [ 130.638348] stack backtrace: [ 130.639062] CPU: 1 PID: 1025 Comm: gtp-tunnel Not tainted 5.2.0-rc6+ #50 [ 130.641318] Call Trace: [ 130.641707] dump_stack+0x7c/0xbb [ 130.642252] ___might_sleep+0x2c0/0x3b0 [ 130.642862] kmem_cache_alloc_trace+0x1cd/0x2b0 [ 130.643591] gtp_genl_new_pdp+0x6c5/0x1150 [gtp] [ 130.644371] genl_family_rcv_msg+0x63a/0x1030 [ 130.645074] ? mutex_lock_io_nested+0x1090/0x1090 [ 130.645845] ? genl_unregister_family+0x630/0x630 [ 130.646592] ? debug_show_all_locks+0x2d0/0x2d0 [ 130.647293] ? check_flags.part.40+0x440/0x440 [ 130.648099] genl_rcv_msg+0xa3/0x130 [ ... ] Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> --- drivers/net/gtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 92ef777a757f..52f35cbeb1dc 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -959,7 +959,7 @@ static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk, } - pctx = kmalloc(sizeof(struct pdp_ctx), GFP_KERNEL); + pctx = kmalloc(sizeof(*pctx), GFP_ATOMIC); if (pctx == NULL) return -ENOMEM; -- 2.17.1

4 years, 10 months

1
0
0 0

[PATCH net 3/6] gtp: remove duplicate code in gtp_dellink()

by Taehee Yoo

gtp_encap_disable() in gtp_dellink() is unnecessary because it will be called by unregister_netdevice(). unregister_netdevice() internally calls gtp_dev_uninit() by ->ndo_uninit(). And gtp_dev_uninit() calls gtp_encap_disable(). Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> --- drivers/net/gtp.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 5101f8c3c99c..92ef777a757f 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -694,7 +694,6 @@ static void gtp_dellink(struct net_device *dev, struct list_head *head) { struct gtp_dev *gtp = netdev_priv(dev); - gtp_encap_disable(gtp); gtp_hashtable_free(gtp); list_del_rcu(&gtp->list); unregister_netdevice_queue(dev, head); -- 2.17.1

4 years, 10 months

1
0
0 0

[PATCH net 2/6] gtp: fix use-after-free in gtp_encap_destroy()

by Taehee Yoo

gtp_encap_destroy() is called twice. 1. When interface is deleted. 2. When udp socket is destroyed. either gtp->sk0 or gtp->sk1u could be freed by sock_put() in gtp_encap_destroy(). so, when gtp_encap_destroy() is called again, it would uses freed sk pointer. patch makes gtp_encap_destroy() to set either gtp->sk0 or gtp->sk1u to null. in addition, both gtp->sk0 and gtp->sk1u pointer are protected by rtnl_lock. so, rtnl_lock() is added. Test command: gtp-link add gtp1 & killall gtp-link ip link del gtp1 Splat looks like: [ 83.182767] BUG: KASAN: use-after-free in __lock_acquire+0x3a20/0x46a0 [ 83.184128] Read of size 8 at addr ffff8880cc7d5360 by task ip/1008 [ 83.185567] CPU: 1 PID: 1008 Comm: ip Not tainted 5.2.0-rc6+ #50 [ 83.188469] Call Trace: [ ... ] [ 83.200126] lock_acquire+0x141/0x380 [ 83.200575] ? lock_sock_nested+0x3a/0xf0 [ 83.201069] _raw_spin_lock_bh+0x38/0x70 [ 83.201551] ? lock_sock_nested+0x3a/0xf0 [ 83.202044] lock_sock_nested+0x3a/0xf0 [ 83.202520] gtp_encap_destroy+0x18/0xe0 [gtp] [ 83.203065] gtp_encap_disable.isra.14+0x13/0x50 [gtp] [ 83.203687] gtp_dellink+0x56/0x170 [gtp] [ 83.204190] rtnl_delete_link+0xb4/0x100 [ ... ] [ 83.236513] Allocated by task 976: [ 83.236925] save_stack+0x19/0x80 [ 83.237332] __kasan_kmalloc.constprop.3+0xa0/0xd0 [ 83.237894] kmem_cache_alloc+0xd8/0x280 [ 83.238360] sk_prot_alloc.isra.42+0x50/0x200 [ 83.238874] sk_alloc+0x32/0x940 [ 83.239264] inet_create+0x283/0xc20 [ 83.239684] __sock_create+0x2dd/0x540 [ 83.240136] __sys_socket+0xca/0x1a0 [ 83.240550] __x64_sys_socket+0x6f/0xb0 [ 83.240998] do_syscall_64+0x9c/0x450 [ 83.241466] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 83.242061] [ 83.242249] Freed by task 0: [ 83.242616] save_stack+0x19/0x80 [ 83.243013] __kasan_slab_free+0x111/0x150 [ 83.243498] kmem_cache_free+0x89/0x250 [ 83.244444] __sk_destruct+0x38f/0x5a0 [ 83.245366] rcu_core+0x7e9/0x1c20 [ 83.245766] __do_softirq+0x213/0x8fa Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> --- drivers/net/gtp.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 939da5442f65..5101f8c3c99c 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -285,13 +285,17 @@ static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb) return gtp_rx(pctx, skb, hdrlen, gtp->role); } -static void gtp_encap_destroy(struct sock *sk) +static void __gtp_encap_destroy(struct sock *sk) { struct gtp_dev *gtp; lock_sock(sk); gtp = sk->sk_user_data; if (gtp) { + if (gtp->sk0 == sk) + gtp->sk0 = NULL; + else + gtp->sk1u = NULL; udp_sk(sk)->encap_type = 0; rcu_assign_sk_user_data(sk, NULL); sock_put(sk); @@ -299,12 +303,19 @@ static void gtp_encap_destroy(struct sock *sk) release_sock(sk); } +static void gtp_encap_destroy(struct sock *sk) +{ + rtnl_lock(); + __gtp_encap_destroy(sk); + rtnl_unlock(); +} + static void gtp_encap_disable_sock(struct sock *sk) { if (!sk) return; - gtp_encap_destroy(sk); + __gtp_encap_destroy(sk); } static void gtp_encap_disable(struct gtp_dev *gtp) @@ -1038,6 +1049,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) return -EINVAL; } + rtnl_lock(); rcu_read_lock(); gtp = gtp_find_dev(sock_net(skb->sk), info->attrs); @@ -1062,6 +1074,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) out_unlock: rcu_read_unlock(); + rtnl_unlock(); return err; } -- 2.17.1

4 years, 10 months

1
0
0 0

[PATCH net 1/6] gtp: fix suspicious RCU usage

by Taehee Yoo

gtp_encap_enable_socket() and gtp_encap_destroy() are not protected by rcu_read_lock(). and it's not safe to write sk->sk_user_data. This patch make these functions to use lock_sock() instead of rcu_dereference_sk_user_data(). Test commands: gtp-link add gtp1 Splat looks like: [ 83.238315] ============================= [ 83.239127] WARNING: suspicious RCU usage [ 83.239702] 5.2.0-rc6+ #49 Not tainted [ 83.240268] ----------------------------- [ 83.241205] drivers/net/gtp.c:799 suspicious rcu_dereference_check() usage! [ 83.243828] [ 83.243828] other info that might help us debug this: [ 83.243828] [ 83.246325] [ 83.246325] rcu_scheduler_active = 2, debug_locks = 1 [ 83.247314] 1 lock held by gtp-link/1008: [ 83.248523] #0: 0000000017772c7f (rtnl_mutex){+.+.}, at: __rtnl_newlink+0x5f5/0x11b0 [ 83.251503] [ 83.251503] stack backtrace: [ 83.252173] CPU: 0 PID: 1008 Comm: gtp-link Not tainted 5.2.0-rc6+ #49 [ 83.253271] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 83.254562] Call Trace: [ 83.254995] dump_stack+0x7c/0xbb [ 83.255567] gtp_encap_enable_socket+0x2df/0x360 [gtp] [ 83.256415] ? gtp_find_dev+0x1a0/0x1a0 [gtp] [ 83.257161] ? memset+0x1f/0x40 [ 83.257843] gtp_newlink+0x90/0xa21 [gtp] [ 83.258497] ? __netlink_ns_capable+0xc3/0xf0 [ 83.259260] __rtnl_newlink+0xb9f/0x11b0 [ 83.260022] ? rtnl_link_unregister+0x230/0x230 [ ... ] Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> --- drivers/net/gtp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index fc45b749db46..939da5442f65 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -289,12 +289,14 @@ static void gtp_encap_destroy(struct sock *sk) { struct gtp_dev *gtp; - gtp = rcu_dereference_sk_user_data(sk); + lock_sock(sk); + gtp = sk->sk_user_data; if (gtp) { udp_sk(sk)->encap_type = 0; rcu_assign_sk_user_data(sk, NULL); sock_put(sk); } + release_sock(sk); } static void gtp_encap_disable_sock(struct sock *sk) @@ -796,7 +798,8 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, goto out_sock; } - if (rcu_dereference_sk_user_data(sock->sk)) { + lock_sock(sock->sk); + if (sock->sk->sk_user_data) { sk = ERR_PTR(-EBUSY); goto out_sock; } @@ -812,6 +815,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg); out_sock: + release_sock(sock->sk); sockfd_put(sock); return sk; } -- 2.17.1

4 years, 10 months

1
0
0 0

high ksoftirqd while using module gtp?

by Tony Clark

Dear All, I've been using the GTP-U kernel module to communicate with a P-GW. Running Fedora 29, kernel 4.18.16-300.fc29.x86_64. At high traffic levels through the GTP-U tunnel I see the performance degrade as 100% CPU is consumed by a single ksoftirqd process. It is running on a multi-cpu machine and as far as I can tell the load is evenly spread across the cpus (ie either manually via smp_affinity, or even irqbalance, checking /proc/interrupts so forth.). Has anyone else experienced this? Is there any particular area you could recommend I investigate to find the root cause of this bottleneck, as i'm starting to scratch my head where to look next... Thanks in advance Tony ---- FYI modinfo gtp filename: /lib/modules/4.18.16-300.fc29.x86_64/kernel/drivers/net/gtp.ko.xz alias: net-pf-16-proto-16-family-gtp alias: rtnl-link-gtp description: Interface driver for GTP encapsulated traffic author: Harald Welte <hwelte(a)sysmocom.de> license: GPL depends: udp_tunnel retpoline: Y intree: Y name: gtp vermagic: 4.18.16-300.fc29.x86_64 SMP mod_unload modinfo udp_tunnel filename: /lib/modules/4.18.16-300.fc29.x86_64/kernel/net/ipv4/udp_tunnel.ko.xz license: GPL depends: retpoline: Y intree: Y name: udp_tunnel vermagic: 4.18.16-300.fc29.x86_64 SMP mod_unload

4 years, 10 months

1
0
0 0

[OSMO_PCU] EGPRS

by Andrey Lavrukhin

Hi Now I'm trying osmo-pcu on octasic-phy. GPRS worked, but I want to get EGPRS. I set 'gprs mode none' in openbsc.cfg and 'egprs only' in osmo-pcu.cfg. And got next error: "Not accepting non-EGPRS phone in EGPRS-only mode". As I found, it is like bug #3499. What does this error depend on and how can it be fixed? How can I test EGPRS? Thanks, Andrey Lavrukhin

5 years, 1 month

3
4
0 0

Problem with the sgsnemu of OsmoGGSN

by ArthurLRJ＠outlook.com

Dear all I am facting the following problems and hope you can help me: - At present, I have two GGSN nodes(such as A and B), I also hava a sgsnemu node which is connected to GGSN-A and hold a PDP context, now I want to connect this PDP context to GGSN-B to simulate the handover of mobile devices between different base stations. How can I do it? - And I I wonder if sgsnemu can generate “Update PDP Context Request” message. Thanks and regards Arthur

5 years, 1 month

3
2
0 0

New osmocom CNI versions released

by Harald Welte

Hi! Just in case not every subscriber here is following the osmocom.org RSS feed: At http://osmocom.org/news/104 we have just announced a bunch of new tagged versions of the Osmocom CNI (cellular network infrastructure) software stack. See the link above for all related details, and links to changelogs. The "network:osmocom:latest" feed already contains builds for Debian 8 and 9, as well as Ubuntu 16.04, 16.10, 17.04, 17.10 and 18.04. Raspbian 9 + Ubuntu 18.10 are currently building, see https://build.opensuse.org/project/monitor/network:osmocom:latest I'd like to thank everyone who has contributed in some way to those new versions. That's primarily the great team of developers, but also everyone helping with testing, bug reports, bug squashing, documentation, etc. Happy hacking, Harald -- - Harald Welte <hwelte(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschaeftsfuehrer / Managing Director: Harald Welte

5 years, 3 months

1
0
0 0

Security Issue

by Dhiraj Mishra

Hi List, I found a security issue in libgtpnl osmocom project, could some one please let me know where to submit such bugs ? Thank you

5 years, 3 months

2
1
0 0

OsmoDevCon 2019 registration

by Harald Welte

Dear fellow Osmocom developers, I'm a bit surprised to notice that not more people have signed up for OsmoDevCon 2019. I guess it was mostly an oversight when the date was originally announced, and not a lack of interest? ;) All details about the event are available at the related wiki page at: https://osmocom.org/projects/osmo-dev-con/wiki/OsmoDevCon2019 Please enter your name at https://osmocom.org/projects/osmo-dev-con/wiki/OsmoDevCon2019#Requested in case you would like to attend. Registering early allows proper planning. Thanks! Looking forward to meeting old and new Osmocom developers in April 2019. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

5 years, 4 months

1
0
0 0

Question about basic usage of GTP kernel module

by Michał Siuda

Hi, I'm trying to build a simple node that would encap/decap between IP and GTP in the user plane. For this I have been using gtp-link and gtp-tunnel tools of the libgtpnl, but with no luck so far. Could anyone please review my setup and let me know what I'm doing wrong? Topology: node1 - DUT, I would like to be able to send a ping from this node such that it is encapsulated into GTP tunnel towards node2. 2 interfaces: - ens6 - represents interface towards MS, has address 20.1.1.1/24 - ens7 - represents interface towards GGSN, has address 10.1.1.1/24 node2 Just a single interface towards node1, address 10.1.1.2/24 Test: On node2, I'm following these steps: - creating a GTP device: # ./gtp-link add gtp-u - adding a GTP tunnel: # ./gtp-tunnel add gtp-u v1 20 10 20.1.1.1 10.1.1.2 # ./gtp-tunnel list version 1 tei 20/10 ms_addr 20.1.1.1 sgsn_addr 10.1.1.2 - adding a route to an address representing APN to use the GTP device: # ip route add 8.8.8.8 src 20.1.1.1 dev gtp-u - Trying to ping 8.8.8.8 Result: I was expecting to see ECMP packets to 8.8.8.8 to be sent out via ens7 towards node2 and encapsulated in GTP. However, I can only see that these packets appear on the gtp-u interface, but are not forwarded. Looking at interface stats on gtp-u, I can see that the ping hits "tx_error" counter. Is there anything I'm missing here? Are any parameters wrong? Or am I misunderstanding the function of the GTP-U kernel support entirely? Any help would be appreciated. Thanks, Michael

5 years, 5 months

1
0
0 0

Can you tell me how to compile and install libgtpnl?

by luo

hello,Please forgive my childishness,Can you tell me how to compile and install libgtpnl?thanks I saw that you wrote the libgtpnl project on github, but there is no readme above.

5 years, 5 months

2
1
0 0

[BUG][OSMO-PCU][OSMO-SGSN] GPRS and EGPRS attach procedure is not working with Kirin Modem phones

by Bipin Jaiswal

Hi, We are using Honor 7X mobile phone with Huawei Kirin modem and observed that GPRS and EGPRS attach is not working with Huawei Kirin Modem phones. There is no issue observed from OSMO-PCU. it seems either Huawei Kirin modem issue or OSMO-SGSN issue. Please check below analysis for this issue. 1- UE send attach request with IMSI and invalid MCC and MNC to SGSN. 2- SGSN send Identity Request with IMEI to UE. 3- UE responded Identity Response with IMEI to SGSN. 4- SGSN sends ATTACH ACCEPT message to SGSN with new PMTSI but UE is not responding ATTACH COMPLETE message to SGSN and resend ATTACH REQUEST message to SGSN. 5- SO SGSN re transmit ATTACH ACCEPT message to UE and after max number of re transmission , SGSN is release UE MM context. It seems that UE is not accepting ATTACH ACCEPT message. We also observed that Huawei Kirin UE is sending wrong LLC data to SGSN. UE had set more bit in RLC LME header and send invalid LLC data with 0x2B. So OSMO-PCU had forward this data to SGSN because more bit is set and SGSN is complaining LLC error for this LLC data. Please look into this issue or let us know if we have fix for this issue. Thanks, Bipin Jaiswal

5 years, 5 months

2
1
0 0

[ASK version support GPRS for USRP ]

by Dzakwan Falih

Hi semua, saya memiliki pertanyaan: 1. Versi berapa yang cocok untuk membangun layanan GPRS.? 2. bagaimana jika saya ingin menginstall GPRS pada satu host bagaimana contoh konfigurasinya, saya sudah membaca manualnya kurang paham. . Hormat Saya, [photo] Muhammad Dzakwan Falih dzakwanfalih.wordpress.com<http://dzakwanfalih.wordpress.com> [https://s3.amazonaws.com/images.wisestamp.com/social_icons/square/facebook.…]<http://www.facebook.com/dzakwan.pilot> [https://s3.amazonaws.com/images.wisestamp.com/social_icons/square/linkedin.…] <http://www.linkedin.com/in/muhammad-dzakwan-falih-2ab30612a/> [https://s3.amazonaws.com/images.wisestamp.com/social_icons/square/twitter.p…] <http://twitter.com/Dz4kwan> [https://s3.amazonaws.com/images.wisestamp.com/social_icons/square/instagram…] <http://www.instagram.com/supernode/>

5 years, 6 months

2
1
0 0

[ASK : Version for build GPRS ]

by Dzakwan Falih

Sorry, I made a mistake in posting. to be honest I am first time using the mailing list Hi all, I have a question: 1. how many Versions suitable for constructing GPRS service.? 2. What if I want to install GPRS on a single host configuration, examples of how I've been reading the manual is less familiar. Hormat Saya, [photo] Muhammad Dzakwan Falih dzakwanfalih.wordpress.com<http://dzakwanfalih.wordpress.com> [https://s3.amazonaws.com/images.wisestamp.com/social_icons/square/facebook.…]<http://www.facebook.com/dzakwan.pilot> [https://s3.amazonaws.com/images.wisestamp.com/social_icons/square/linkedin.…] <http://www.linkedin.com/in/muhammad-dzakwan-falih-2ab30612a/> [https://s3.amazonaws.com/images.wisestamp.com/social_icons/square/twitter.p…] <http://twitter.com/Dz4kwan> [https://s3.amazonaws.com/images.wisestamp.com/social_icons/square/instagram…] <http://www.instagram.com/supernode/>

5 years, 6 months

1
0
0 0

OsmoDevCon 2019 date poll

by Harald Welte

Dear all, I would like to get your input as to when we should schedule OsmoDevCon 2019. NOTE: OsmoDevCon is our "for developers by developers" event, not to be confused with OsmoCon, our public conference. If we want to stay with the usual "Friday through Monday in April" arrangement, we have the following options: April 05-08, 2019 April 12-15, 2019 April 26-29, 2019 The one missing weekend in the list above is the easter weekend, which is probably a good idea to exclude as flights and hotels are more expensive during that time, and people might have other plans during holidays. I would like to invite anyone planning to attend the Osmocom Developer Conference 2019 to participate in the poll at https://dudle.inf.tu-dresden.de/OsmoDevCon2019/ to state their availability/preference. The Dudle only shows the first day of the four days of OsmoDevCon. Looking forward to your feedback so we can settle on a date soon. Thanks! Kind regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

5 years, 6 months

1
0
0 0

OsmoGGSN - Centos 7 Support

by Duleep Thilakarathne

Hi i am old user of openGGSN and planned to test OsmoGGSN. is it possible to compile osmoGGSN in Centos 7. is there any limitation. regards DT

5 years, 6 months

2
1
0 0

Problem with SGSN Location Update Reject during UE attach

by Lam Ngoc Tuan

Dear all We are facing the following problem and hope you can help us: - We use OSMO as UMTS core emulation, working with our real NodeB - During UE attach procedure we see from SGSN "Location Update Reject" and afterthat UE is released. - We do the comparison test with real UMTS core and our real NodeB, here it works properly, UE can attach successful. We assume there is some Osmo configuration problem but we have not found the root cause, we very appreciate if you can take a look and give us some advice. Here is the current message flow of UE attach 10.2.9.200 10.2.9.139 RANAP 170 (RUA) InitialUE-Message (DTAP) (MM) Location Updating Request 10.2.9.139 10.2.9.200 RANAP 158 SACK (RUA) DirectTransfer (DTAP) (MM) Authentication Request 10.2.9.200 10.2.9.139 RANAP 222 SACK (RUA) InitialUE-Message (DTAP) (GMM) Attach Request 10.2.9.139 10.2.9.200 RANAP 122 SACK (RUA) DirectTransfer (DTAP) (GMM) Identity Request 10.2.9.200 10.2.9.139 RANAP 118 (RUA) DirectTransfer (DTAP) (MM) Authentication Failure 10.2.9.139 10.2.9.200 RANAP 158 SACK (RUA) DirectTransfer (DTAP) (MM) Authentication Request 10.2.9.200 10.2.9.139 RANAP 154 SACK (RUA) DirectTransfer (DTAP) (GMM) Identity Response 10.2.9.139 10.2.9.200 RANAP 162 SACK (RUA) DirectTransfer (DTAP) (GMM) Authentication and Ciphering Req 10.2.9.200 10.2.9.139 RANAP 110 (RUA) DirectTransfer (DTAP) (MM) Authentication Response 10.2.9.139 10.2.9.200 RANAP 138 SACK (RUA) SecurityModeCommand 10.2.9.200 10.2.9.139 RANAP 98 (RUA) SecurityModeComplete 10.2.9.139 10.2.9.200 RANAP 122 SACK (RUA) CommonID 10.2.9.200 10.2.9.139 RANAP 166 SACK (RUA) DirectTransfer (DTAP) (GMM) Authentication and Ciphering Resp 10.2.9.139 10.2.9.200 RANAP 134 SACK (RUA) DirectTransfer (DTAP) (MM) Location Updating Accept 10.2.9.139 10.2.9.200 RANAP 122 (RUA) SecurityModeCommand --> 10.2.9.139 10.2.9.200 RANAP 106 (RUA) DirectTransfer (DTAP) (MM) Location Updating Reject 10.2.9.139 10.2.9.200 RANAP 102 (RUA) Iu-ReleaseCommand 10.2.9.200 10.2.9.139 RANAP 114 SACK (RUA) Iu-ReleaseComplete 10.2.9.200 10.2.9.139 RANAP 102 (RUA) SecurityModeReject 10.2.9.200 10.2.9.139 RANAP 102 (RUA) Iu-ReleaseRequest 10.2.9.139 10.2.9.200 RANAP 118 SACK (RUA) Iu-ReleaseCommand 10.2.9.200 10.2.9.139 RANAP 114 SACK (RUA) Iu-ReleaseComplete Thanks and regards Tuan Lam

5 years, 6 months

2
4
0 0

Build failed in Jenkins: master-osmo-sgsn

by Harald Welte

Dear fellow Osmocom developers, During the past hours, we've been experiencing master-osmo-sgsn build failures. It coincides with some libosmocore.git vty change merge, it would be great if people working on this and/or osmo-sgsn can have a look. Thanks! -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

5 years, 7 months

1
0
0 0

UE Unable to Obtain IP Address | Flooding error logs in OSMO-PCU

by Ron

Hi Community, We tried to used the GPRS capability of OSMOCOM. Installation and configuration were based in the URL provided below: https://osmocom.org/projects/cellular-infrastructure/wiki/Osmocom_Network_I… We successfully installed the needed elements to run GPRS and we were able to run the following: osmo-msc osmo-stp osmo-hnbgw (optional) osmo-ggsn osmo-sgsn osmo-mgw osmo-bsc osmo-trx-uhd osmo-hlr osmo-pcu UE were able to camp but IP Address is unavailable (checked it under Settings > About Phone > Status) No session / request coming in the OSMO-SGSN. We are also flooded with this log in OSMO-PCU: <000c> gprs_bssgp_pcu.cpp:848 Sending unblock on BVCI 1800 <000c> gprs_bssgp_bss.c:274 BSSGP (BVCI=1800) Tx BVC-BLOCK <000c> gprs_bssgp.c:288 Cell 001-01-23-0 CI 0 on BVCI 1800 <000c> gprs_bssgp_bss.c:294 BSSGP (BVCI=1800) Tx BVC-RESET CAUSE=O&M intervention <000c> gprs_bssgp.c:550 BSSGP BVCI=0 Rx BVC STATUS, cause=Protocol error - unspecified <000c> gprs_bssgp_pcu.cpp:354 Rx BSSGP BVCI=0 (SIGN) PDU type BVC-UNBLOCK unknown <000c> gprs_bssgp_util.c:238 BSSGP BVCI=0 Tx STATUS, cause=Protocol error - unspecified <000c> gprs_bssgp_pcu.cpp:304 Rx BSSGP BVCI=0 (SIGN) BVC_RESET_ACK <000c> gprs_bssgp_pcu.cpp:848 Sending unblock on BVCI 1800 <000c> gprs_bssgp_bss.c:274 BSSGP (BVCI=1800) Tx BVC-BLOCK <000c> gprs_bssgp.c:288 Cell 001-01-23-0 CI 0 on BVCI 1800 <000c> gprs_bssgp_bss.c:294 BSSGP (BVCI=1800) Tx BVC-RESET CAUSE=O&M intervention <000c> gprs_bssgp.c:550 BSSGP BVCI=0 Rx BVC STATUS, cause=Protocol error - unspecified <000c> gprs_bssgp_pcu.cpp:354 Rx BSSGP BVCI=0 (SIGN) PDU type BVC-UNBLOCK unknown <000c> gprs_bssgp_util.c:238 BSSGP BVCI=0 Tx STATUS, cause=Protocol error - unspecified <000c> gprs_bssgp_pcu.cpp:304 Rx BSSGP BVCI=0 (SIGN) BVC_RESET_ACK <000c> gprs_bssgp_pcu.cpp:848 Sending unblock on BVCI 1800 <000c> gprs_bssgp_bss.c:274 BSSGP (BVCI=1800) Tx BVC-BLOCK <000c> gprs_bssgp.c:288 Cell 001-01-23-0 CI 0 on BVCI 1800 <000c> gprs_bssgp_bss.c:294 BSSGP (BVCI=1800) Tx BVC-RESET CAUSE=O&M intervention <000c> gprs_bssgp.c:550 BSSGP BVCI=0 Rx BVC STATUS, cause=Protocol error - unspecified <000c> gprs_bssgp_pcu.cpp:354 Rx BSSGP BVCI=0 (SIGN) PDU type BVC-UNBLOCK unknown <000c> gprs_bssgp_util.c:238 BSSGP BVCI=0 Tx STATUS, cause=Protocol error - unspecified <000c> gprs_bssgp_pcu.cpp:304 Rx BSSGP BVCI=0 (SIGN) BVC_RESET_ACK Any suggestion / comments what seems to be the problem with our setup? TIA. Best Regard, Ron Menez ron.menez(a)entropysolution.com<mailto:ron.menez@entropysolution.com>

5 years, 8 months

2
2
0 0

OsmoCon 2018 draft schedule announced

by Harald Welte

Dear Osmocom community, the first schedule of the 2018 incarnation of OsmoCon 2018 has been announced, see http://osmocom.org/news/99 for the announcment and https://pretalx.sysmocom.de/osmocon2018/schedule/ for the actual schedule. At OsmoCon, we are not targetting developers, but more the wider community and Osmocom users. It would be great to meet many of you and hear more about your relation to Osmocom. Tickets are available from https://pretix.sysmocom.de/sysmocom/osmocon2018/, and until August 31st the early bird discount still applies. For those with a community / "just for fun" background and no employer that would cover the ticket, we have a number of subsidized community discount vouchers available. See the OsmoCon 2018 wiki page at https://osmocom.org/projects/osmo-dev-con/wiki/OsmoCon2018 for more information. Looking forward to meeting as many of you as possible in roughly two months from now, Harald Welte -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

5 years, 8 months

1
0
0 0

SGSN TTCN3 update

by Alexander Couzens

Hi, I've pushed my SGSN Branch "attach fsm" where I reworked the Attach Request into an FSM together with a TTCN branch (replacing unit tests) to gerrit. When both branches applied upstream, we're up to 42 tests. However these 4 test cases are still open: pass->FAIL SGSN_Tests.TC_attach_pdp_act_deact_mt_t3395_expire => TEID wrong. Cleaning up the internal SGSN seems to fail. xfail SGSN_Tests.TC_attach_gsup_lu_timeout => HLR interaction xfail SGSN_Tests.TC_attach_gsup_lu_reject => HLR interaction xfail SGSN_Tests.TC_attach_second_attempt => HLR interaction Best, lynxis -- Alexander Couzens mail: lynxis(a)fe80.eu jabber: lynxis(a)fe80.eu mobile: +4915123277221 gpg: 390D CF78 8BF9 AA50 4F8F F1E2 C29E 9DA6 A0DF 8604

5 years, 9 months

1
0
0 0

[PATCH net-next 0/2] constify nla_policy

by Stephen Hemminger

Almost all places that use nla_policy declare it const. A couple of drivers didn't but that is fixable. Stephen Hemminger (2): nbd: constify nla_policy gtp: constify nla_policy drivers/block/nbd.c | 6 +++--- drivers/net/gtp.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) -- 2.18.0

5 years, 9 months

1
2
0 0

Data Rate of EGPRS is Too Low

by XINKE ZHANG

Hi all, I have set up the EGPRS network using software bundles (osmo-nitb + osmo-bts-trx + osmo-trx + osmo-pcu + osmo-sgsn + openggsn) based on the USRP B210 platform. Now the cell phone can connect to the EGPRS network, but the network is not stable and the data rate is too low (only about 8kbs). Is this data rate correct? If not, could you pls send me some working config files? Thank you. Best Regards, Xinke

5 years, 10 months

3
8
0 0

GPRS doesn't work

by weng alexa

Hi all, I set up the EGPRS network using software bundles (osmo-bts-trx + osmo-trx + osmo-pcu + osmo-sgsn + osmo-ggsn + osmo-bsc + osmo-msc + osmo-hlr) based on the USRP B210 platform. Now the cell phone can connect to the EGPRS network, but the phone has no IP address. All the config files are in the attachments, could you help we find what's wrong? Thanks sincerely All of the osmo-pcu's log is like the below: 20180625043250233 DRLCMACMEAS <0007> gprs_rlcmac_meas.cpp:183 DL Bandwitdh of IMSI=xxxxxxxxxxxxxxxx/ TLLI=0xb6ccf813: 190 KBits/s 20180625043250233 DTBFDL <0009> tbf_dl.cpp:863 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Scheduled Ack/Nack polling on FN=2035509, TS=4 20180625043250334 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250334 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250353 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250353 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250353 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250353 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250371 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250371 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250371 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250371 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250389 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250389 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250389 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250389 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250408 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250408 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250408 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250408 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250431 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250431 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250431 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250431 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250449 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250449 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250449 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250449 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250468 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250468 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250468 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250468 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250472 DTBF <0008> tbf_dl.cpp:648 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) changes poll state from GPRS_RLCMAC_POLL_SCHED to GPRS_RLCMAC_POLL_NONE 20180625043250472 DTBF <0008> pdch.cpp:407 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) RX: [PCU <- BTS] Packet Downlink Ack/Nack 20180625043250491 DTBFDL <0009> tbf_dl.cpp:863 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Scheduled Ack/Nack polling on FN=2035566, TS=4 20180625043250588 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250588 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250611 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250611 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250611 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250611 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250629 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250629 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250629 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250630 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250648 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250648 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250648 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250648 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250671 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250671 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250671 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250671 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250690 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250690 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250690 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250690 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250708 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250708 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250708 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250708 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250731 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250731 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250731 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250731 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250737 DTBF <0008> tbf_dl.cpp:648 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) changes poll state from GPRS_RLCMAC_POLL_SCHED to GPRS_RLCMAC_POLL_NONE 20180625043250737 DTBF <0008> pdch.cpp:407 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) RX: [PCU <- BTS] Packet Downlink Ack/Nack 20180625043250750 DTBFDL <0009> tbf_dl.cpp:863 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Scheduled Ack/Nack polling on FN=2035622, TS=4 20180625043250851 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250851 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250880 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250880 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250880 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250880 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250888 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250888 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250888 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250888 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250911 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250911 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250911 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250911 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250930 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250930 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250930 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250930 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250948 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250948 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250948 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250948 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043250971 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043250971 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043250971 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043250971 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043251009 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043251010 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043251010 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043251010 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043251010 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043251010 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043251010 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043251010 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043251011 DTBF <0008> tbf_dl.cpp:648 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) changes poll state from GPRS_RLCMAC_POLL_SCHED to GPRS_RLCMAC_POLL_NONE 20180625043251011 DTBF <0008> pdch.cpp:407 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) RX: [PCU <- BTS] Packet Downlink Ack/Nack 20180625043251031 DTBFDL <0009> tbf_dl.cpp:863 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Scheduled Ack/Nack polling on FN=2035683, TS=4 20180625043251128 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043251128 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043251151 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043251151 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043251151 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043251151 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043251170 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043251170 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043251170 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043251170 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043251188 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043251188 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043251188 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043251188 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043251211 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043251211 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043251211 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043251211 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043251230 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043251230 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043251230 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043251230 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043251248 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043251248 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043251248 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043251248 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043251271 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 2 (first control TS 4) 20180625043251271 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 3 (first control TS 4) 20180625043251271 DTBF <0008> tbf.cpp:718 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling is already scheduled 20180625043251271 DTBF <0008> tbf.cpp:714 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) Polling cannot be scheduled in this TS 5 (first control TS 4) 20180625043251272 DTBF <0008> tbf_dl.cpp:648 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) changes poll state from GPRS_RLCMAC_POLL_SCHED to GPRS_RLCMAC_POLL_NONE 20180625043251272 DTBF <0008> pdch.cpp:407 TBF(TFI=0 TLLI=0xb6ccf813 DIR=DL STATE=FLOW) RX: [PCU <- BTS] Packet Downlink Ack/Nack 20180625043251290 DRLCMACMEAS <0007> gprs_rlcmac_meas.cpp:183 DL Bandwitdh of IMSI=xxxxxxxxxxxxxxxxxx/ TLLI=0xb6ccf813: 186 KBits/s Part of the osmo-sgsn's log is shown below: 20180625042017231 DMM <0002> gprs_gmm.c:1272 MM(---/ffffffff) -> GMM ATTACH REQUEST MI(4140627987) type="GPRS attach" 20180625042017231 DMM <0002> gprs_sgsn.c:237 MM(/00000000) Allocated with GEA0 cipher. 20180625042017231 DLGLOBAL <001d> rate_ctr.c:88 validating counter group 0x558216d5ee00(sgsn:mmctx) with 11 counters 20180625042017233 DMM <0002> gprs_gmm.c:556 MM(/e35372d8) <- GPRS IDENTITY REQUEST: mi_type=IMEI 20180625042018409 DBSSGP <0011> gprs_bssgp.c:392 BSSGP TLLI=0xb6ccf813 Rx UPLINK-UNITDATA 20180625042018409 DLLC <0012> gprs_llc_parse.c:81 LLC SAPI=1 C U GEA0 IOV-UI=0x000000 FCS=0x8b6c20 CMD=UI DATA 20180625042018410 DMM <0002> gprs_gmm.c:1195 MM(/e35372d8) -> GMM IDENTITY RESPONSE: MI(IMEI)=866049037683470 20180625042018410 DMM <0002> gprs_gmm.c:556 MM(/e35372d8) <- GPRS IDENTITY REQUEST: mi_type=IMSI 20180625042019133 DBSSGP <0011> gprs_bssgp.c:392 BSSGP TLLI=0xb6ccf813 Rx UPLINK-UNITDATA 20180625042019133 DLLC <0012> gprs_llc_parse.c:81 LLC SAPI=1 C U GEA0 IOV-UI=0x000000 FCS=0xa77256 CMD=UI DATA 20180625042019133 DMM <0002> gprs_gmm.c:1195 MM(/e35372d8) -> GMM IDENTITY RESPONSE: MI(IMSI)=xxxxxxxxxxxxxxx 20180625042019133 DMM <0002> sgsn_auth.c:161 MM(xxxxxxxxxxxxxxx/e35372d8) Requesting authorization 20180625042019133 DMM <0002> sgsn_auth.c:220 MM(xxxxxxxxxxxxxxx/e35372d8) Updating authorization (unknown -> accepted) 20180625042019133 DMM <0002> sgsn_auth.c:249 MM(xxxxxxxxxxxxxxx/e35372d8) Got authorization update: state unknown -> accepted 20180625042019133 DMM <0002> gprs_gmm.c:1119 MM(xxxxxxxxxxxxxxx/e35372d8) Authorized, continuing procedure, IMSI=xxxxxxxxxxxxxxx 20180625042019133 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/e35372d8) <- GPRS ATTACH ACCEPT (new P-TMSI=0xe35372d8) 20180625042024027 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042024483 DGPRS <000f> gprs_sgsn.c:912 Checking for inactive LLMEs, time = 341 20180625042024615 DLGSUP <0027> gsup_client.c:244 GSUP ping callback (connected, got PONG) 20180625042024615 DLGSUP <0027> gsup_client.c:264 GSUP sending PING 20180625042024615 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042024615 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042024615 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042024615 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042024615 DLINP <001f> input/ipa.c:138 127.0.0.1:4222 connected read 20180625042024615 DLINP <001f> input/ipa.c:56 127.0.0.1:4222 message received 20180625042024615 DLGSUP <0027> gsup_client.c:201 GSUP receiving PONG 20180625042025134 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/e35372d8) <- GPRS ATTACH ACCEPT (new P-TMSI=0xe35372d8) 20180625042031136 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/e35372d8) <- GPRS ATTACH ACCEPT (new P-TMSI=0xe35372d8) 20180625042034027 DNS <0010> gprs_ns.c:638 NSEI=1800 Timer expired in mode tns-test (30 seconds) 20180625042034027 DNS <0010> gprs_ns.c:571 NSEI=1800 Tx NS ALIVE (NSVCI=1800) 20180625042034027 DNS <0010> gprs_ns.c:610 NSEI=1800 Starting timer in mode tns-alive (3 seconds) 20180625042034027 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042034028 DNS <0010> gprs_ns.c:584 NSEI=1800 Tx NS ALIVE_ACK (NSVCI=1800) 20180625042034028 DNS <0010> gprs_ns.c:610 NSEI=1800 Starting timer in mode tns-test (30 seconds) 20180625042037138 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/e35372d8) <- GPRS ATTACH ACCEPT (new P-TMSI=0xe35372d8) 20180625042037889 DBSSGP <0011> gprs_bssgp.c:392 BSSGP TLLI=0xb6ccf813 Rx UPLINK-UNITDATA 20180625042037889 DLLC <0012> gprs_llc_parse.c:81 LLC SAPI=1 C U GEA0 IOV-UI=0x000000 FCS=0x5b3c8d CMD=UI DATA 20180625042037889 DMM <0002> gprs_gmm.c:1272 MM(xxxxxxxxxxxxxxx/e35372d8) -> GMM ATTACH REQUEST MI(4140627987) type="GPRS attach" 20180625042037889 DMM <0002> gprs_gmm.c:228 MM(xxxxxxxxxxxxxxx/e35372d8) Starting MM timer 3350 while old timer 3350 pending 20180625042037889 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/e35372d8) <- GPRS ATTACH ACCEPT (new P-TMSI=0xe35372d8) 20180625042043889 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/e35372d8) <- GPRS ATTACH ACCEPT (new P-TMSI=0xe35372d8) 20180625042044027 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042044616 DLGSUP <0027> gsup_client.c:244 GSUP ping callback (connected, got PONG) 20180625042044616 DLGSUP <0027> gsup_client.c:264 GSUP sending PING 20180625042044616 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042044616 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042044616 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042044616 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042044616 DLINP <001f> input/ipa.c:138 127.0.0.1:4222 connected read 20180625042044616 DLINP <001f> input/ipa.c:56 127.0.0.1:4222 message received 20180625042044616 DLGSUP <0027> gsup_client.c:201 GSUP receiving PONG 20180625042047034 DBSSGP <0011> gprs_bssgp.c:392 BSSGP TLLI=0xb6ccf813 Rx UPLINK-UNITDATA 20180625042047034 DLLC <0012> gprs_llc_parse.c:81 LLC SAPI=1 C U GEA0 IOV-UI=0x000000 FCS=0x75dfce CMD=UI DATA 20180625042047034 DMM <0002> gprs_gmm.c:1272 MM(xxxxxxxxxxxxxxx/e35372d8) -> GMM ATTACH REQUEST MI(4140627987) type="GPRS attach" 20180625042047034 DMM <0002> gprs_gmm.c:228 MM(xxxxxxxxxxxxxxx/e35372d8) Starting MM timer 3350 while old timer 3350 pending 20180625042047034 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/e35372d8) <- GPRS ATTACH ACCEPT (new P-TMSI=0xe35372d8) 20180625042053036 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/e35372d8) <- GPRS ATTACH ACCEPT (new P-TMSI=0xe35372d8) 20180625042054028 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042054484 DGPRS <000f> gprs_sgsn.c:912 Checking for inactive LLMEs, time = 371 20180625042059038 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/e35372d8) <- GPRS ATTACH ACCEPT (new P-TMSI=0xe35372d8) 20180625042102113 DBSSGP <0011> gprs_bssgp.c:392 BSSGP TLLI=0xb6ccf813 Rx UPLINK-UNITDATA 20180625042102113 DLLC <0012> gprs_llc_parse.c:81 LLC SAPI=1 C U GEA0 IOV-UI=0x000000 FCS=0x06fa0b CMD=UI DATA 20180625042102113 DMM <0002> gprs_gmm.c:1272 MM(xxxxxxxxxxxxxxx/e35372d8) -> GMM ATTACH REQUEST MI(4140627987) type="GPRS attach" 20180625042102113 DMM <0002> gprs_gmm.c:228 MM(xxxxxxxxxxxxxxx/e35372d8) Starting MM timer 3350 while old timer 3350 pending 20180625042102113 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/e35372d8) <- GPRS ATTACH ACCEPT (new P-TMSI=0xe35372d8) 20180625042104028 DNS <0010> gprs_ns.c:638 NSEI=1800 Timer expired in mode tns-test (30 seconds) 20180625042104028 DNS <0010> gprs_ns.c:571 NSEI=1800 Tx NS ALIVE (NSVCI=1800) 20180625042104028 DNS <0010> gprs_ns.c:610 NSEI=1800 Starting timer in mode tns-alive (3 seconds) 20180625042104028 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042104028 DNS <0010> gprs_ns.c:584 NSEI=1800 Tx NS ALIVE_ACK (NSVCI=1800) 20180625042104028 DNS <0010> gprs_ns.c:610 NSEI=1800 Starting timer in mode tns-test (30 seconds) 20180625042104617 DLGSUP <0027> gsup_client.c:244 GSUP ping callback (connected, got PONG) 20180625042104617 DLGSUP <0027> gsup_client.c:264 GSUP sending PING 20180625042104617 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042104617 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042104617 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042104617 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042104617 DLINP <001f> input/ipa.c:138 127.0.0.1:4222 connected read 20180625042104617 DLINP <001f> input/ipa.c:56 127.0.0.1:4222 message received 20180625042104617 DLGSUP <0027> gsup_client.c:201 GSUP receiving PONG 20180625042108114 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/e35372d8) <- GPRS ATTACH ACCEPT (new P-TMSI=0xe35372d8) 20180625042114030 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042114116 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/e35372d8) <- GPRS ATTACH ACCEPT (new P-TMSI=0xe35372d8) 20180625042120117 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/e35372d8) <- GPRS ATTACH ACCEPT (new P-TMSI=0xe35372d8) 20180625042124030 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042124484 DGPRS <000f> gprs_sgsn.c:912 Checking for inactive LLMEs, time = 401 20180625042124617 DLGSUP <0027> gsup_client.c:244 GSUP ping callback (connected, got PONG) 20180625042124617 DLGSUP <0027> gsup_client.c:264 GSUP sending PING 20180625042124617 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042124617 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042124617 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042124617 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042124617 DLINP <001f> input/ipa.c:138 127.0.0.1:4222 connected read 20180625042124617 DLINP <001f> input/ipa.c:56 127.0.0.1:4222 message received 20180625042124617 DLGSUP <0027> gsup_client.c:201 GSUP receiving PONG 20180625042126121 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/e35372d8) <- GPRS ATTACH ACCEPT (new P-TMSI=0xe35372d8) 20180625042132125 DMM <0002> gprs_gmm.c:2108 MM(xxxxxxxxxxxxxxx/e35372d8) T3350 expired >= 5 times 20180625042132125 DMM <0002> gprs_gmm.c:313 MM(xxxxxxxxxxxxxxx/e35372d8) Cleaning MM context due to T3350 20180625042132791 DBSSGP <0011> gprs_bssgp.c:392 BSSGP TLLI=0xb6ccf813 Rx UPLINK-UNITDATA 20180625042132791 DLLC <0012> gprs_llc.c:526 LLC RX: unknown TLLI 0xb6ccf813, creating LLME on the fly 20180625042132791 DLLC <0012> gprs_llc_parse.c:81 LLC SAPI=1 C U GEA0 IOV-UI=0x000000 FCS=0xe0b181 CMD=UI DATA 20180625042132791 DMM <0002> gprs_gmm.c:1272 MM(---/ffffffff) -> GMM ATTACH REQUEST MI(4140627987) type="GPRS attach" 20180625042132791 DMM <0002> gprs_sgsn.c:237 MM(/00000000) Allocated with GEA0 cipher. 20180625042132791 DLGLOBAL <001d> rate_ctr.c:88 validating counter group 0x558216d5ee00(sgsn:mmctx) with 11 counters 20180625042132791 DMM <0002> gprs_gmm.c:556 MM(/f2d9d8dd) <- GPRS IDENTITY REQUEST: mi_type=IMEI 20180625042133968 DBSSGP <0011> gprs_bssgp.c:392 BSSGP TLLI=0xb6ccf813 Rx UPLINK-UNITDATA 20180625042133968 DLLC <0012> gprs_llc_parse.c:81 LLC SAPI=1 C U GEA0 IOV-UI=0x000000 FCS=0x607d37 CMD=UI DATA 20180625042133968 DMM <0002> gprs_gmm.c:1195 MM(/f2d9d8dd) -> GMM IDENTITY RESPONSE: MI(IMEI)=866049037683470 20180625042133968 DMM <0002> gprs_gmm.c:556 MM(/f2d9d8dd) <- GPRS IDENTITY REQUEST: mi_type=IMSI 20180625042134028 DNS <0010> gprs_ns.c:638 NSEI=1800 Timer expired in mode tns-test (30 seconds) 20180625042134028 DNS <0010> gprs_ns.c:571 NSEI=1800 Tx NS ALIVE (NSVCI=1800) 20180625042134028 DNS <0010> gprs_ns.c:610 NSEI=1800 Starting timer in mode tns-alive (3 seconds) 20180625042134028 DNS <0010> gprs_ns.c:584 NSEI=1800 Tx NS ALIVE_ACK (NSVCI=1800) 20180625042134028 DNS <0010> gprs_ns.c:610 NSEI=1800 Starting timer in mode tns-test (30 seconds) 20180625042134030 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042134685 DBSSGP <0011> gprs_bssgp.c:392 BSSGP TLLI=0xb6ccf813 Rx UPLINK-UNITDATA 20180625042134685 DLLC <0012> gprs_llc_parse.c:81 LLC SAPI=1 C U GEA0 IOV-UI=0x000000 FCS=0xfe7d5b CMD=UI DATA 20180625042134685 DMM <0002> gprs_gmm.c:1195 MM(/f2d9d8dd) -> GMM IDENTITY RESPONSE: MI(IMSI)=xxxxxxxxxxxxxxx 20180625042134685 DMM <0002> sgsn_auth.c:161 MM(xxxxxxxxxxxxxxx/f2d9d8dd) Requesting authorization 20180625042134685 DMM <0002> sgsn_auth.c:220 MM(xxxxxxxxxxxxxxx/f2d9d8dd) Updating authorization (unknown -> accepted) 20180625042134685 DMM <0002> sgsn_auth.c:249 MM(xxxxxxxxxxxxxxx/f2d9d8dd) Got authorization update: state unknown -> accepted 20180625042134685 DMM <0002> gprs_gmm.c:1119 MM(xxxxxxxxxxxxxxx/f2d9d8dd) Authorized, continuing procedure, IMSI=xxxxxxxxxxxxxxx 20180625042134685 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042140686 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042144031 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042144618 DLGSUP <0027> gsup_client.c:244 GSUP ping callback (connected, got PONG) 20180625042144618 DLGSUP <0027> gsup_client.c:264 GSUP sending PING 20180625042144618 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042144618 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042144618 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042144618 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042144618 DLINP <001f> input/ipa.c:138 127.0.0.1:4222 connected read 20180625042144618 DLINP <001f> input/ipa.c:56 127.0.0.1:4222 message received 20180625042144618 DLGSUP <0027> gsup_client.c:201 GSUP receiving PONG 20180625042146689 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042147289 DBSSGP <0011> gprs_bssgp.c:392 BSSGP TLLI=0xb6ccf813 Rx UPLINK-UNITDATA 20180625042147289 DLLC <0012> gprs_llc_parse.c:81 LLC SAPI=1 C U GEA0 IOV-UI=0x000000 FCS=0x939444 CMD=UI DATA 20180625042147289 DMM <0002> gprs_gmm.c:1272 MM(xxxxxxxxxxxxxxx/f2d9d8dd) -> GMM ATTACH REQUEST MI(4140627987) type="GPRS attach" 20180625042147289 DMM <0002> gprs_gmm.c:228 MM(xxxxxxxxxxxxxxx/f2d9d8dd) Starting MM timer 3350 while old timer 3350 pending 20180625042147289 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042153290 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042154031 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042154485 DGPRS <000f> gprs_sgsn.c:912 Checking for inactive LLMEs, time = 431 20180625042159292 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042202149 DBSSGP <0011> gprs_bssgp.c:392 BSSGP TLLI=0xb6ccf813 Rx UPLINK-UNITDATA 20180625042202149 DLLC <0012> gprs_llc_parse.c:81 LLC SAPI=1 C U GEA0 IOV-UI=0x000000 FCS=0x5b3c8d CMD=UI DATA 20180625042202149 DMM <0002> gprs_gmm.c:1272 MM(xxxxxxxxxxxxxxx/f2d9d8dd) -> GMM ATTACH REQUEST MI(4140627987) type="GPRS attach" 20180625042202149 DMM <0002> gprs_gmm.c:228 MM(xxxxxxxxxxxxxxx/f2d9d8dd) Starting MM timer 3350 while old timer 3350 pending 20180625042202149 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042204029 DNS <0010> gprs_ns.c:638 NSEI=1800 Timer expired in mode tns-test (30 seconds) 20180625042204029 DNS <0010> gprs_ns.c:571 NSEI=1800 Tx NS ALIVE (NSVCI=1800) 20180625042204029 DNS <0010> gprs_ns.c:610 NSEI=1800 Starting timer in mode tns-alive (3 seconds) 20180625042204029 DNS <0010> gprs_ns.c:584 NSEI=1800 Tx NS ALIVE_ACK (NSVCI=1800) 20180625042204029 DNS <0010> gprs_ns.c:610 NSEI=1800 Starting timer in mode tns-test (30 seconds) 20180625042204031 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042204619 DLGSUP <0027> gsup_client.c:244 GSUP ping callback (connected, got PONG) 20180625042204619 DLGSUP <0027> gsup_client.c:264 GSUP sending PING 20180625042204619 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042204619 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042204619 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042204619 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042204619 DLINP <001f> input/ipa.c:138 127.0.0.1:4222 connected read 20180625042204619 DLINP <001f> input/ipa.c:56 127.0.0.1:4222 message received 20180625042204619 DLGSUP <0027> gsup_client.c:201 GSUP receiving PONG 20180625042208149 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042214031 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042214150 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042216947 DBSSGP <0011> gprs_bssgp.c:392 BSSGP TLLI=0xb6ccf813 Rx UPLINK-UNITDATA 20180625042216947 DLLC <0012> gprs_llc_parse.c:81 LLC SAPI=1 C U GEA0 IOV-UI=0x000000 FCS=0x75dfce CMD=UI DATA 20180625042216947 DMM <0002> gprs_gmm.c:1272 MM(xxxxxxxxxxxxxxx/f2d9d8dd) -> GMM ATTACH REQUEST MI(4140627987) type="GPRS attach" 20180625042216947 DMM <0002> gprs_gmm.c:228 MM(xxxxxxxxxxxxxxx/f2d9d8dd) Starting MM timer 3350 while old timer 3350 pending 20180625042216947 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042222948 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042224031 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042224486 DGPRS <000f> gprs_sgsn.c:912 Checking for inactive LLMEs, time = 461 20180625042224619 DLGSUP <0027> gsup_client.c:244 GSUP ping callback (connected, got PONG) 20180625042224619 DLGSUP <0027> gsup_client.c:264 GSUP sending PING 20180625042224619 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042224619 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042224619 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042224619 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042224619 DLINP <001f> input/ipa.c:138 127.0.0.1:4222 connected read 20180625042224619 DLINP <001f> input/ipa.c:56 127.0.0.1:4222 message received 20180625042224619 DLGSUP <0027> gsup_client.c:201 GSUP receiving PONG 20180625042228950 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042232086 DBSSGP <0011> gprs_bssgp.c:392 BSSGP TLLI=0xb6ccf813 Rx UPLINK-UNITDATA 20180625042232086 DLLC <0012> gprs_llc_parse.c:81 LLC SAPI=1 C U GEA0 IOV-UI=0x000000 FCS=0x06fa0b CMD=UI DATA 20180625042232086 DMM <0002> gprs_gmm.c:1272 MM(xxxxxxxxxxxxxxx/f2d9d8dd) -> GMM ATTACH REQUEST MI(4140627987) type="GPRS attach" 20180625042232086 DMM <0002> gprs_gmm.c:228 MM(xxxxxxxxxxxxxxx/f2d9d8dd) Starting MM timer 3350 while old timer 3350 pending 20180625042232086 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042234029 DNS <0010> gprs_ns.c:638 NSEI=1800 Timer expired in mode tns-test (30 seconds) 20180625042234029 DNS <0010> gprs_ns.c:571 NSEI=1800 Tx NS ALIVE (NSVCI=1800) 20180625042234029 DNS <0010> gprs_ns.c:610 NSEI=1800 Starting timer in mode tns-alive (3 seconds) 20180625042234029 DNS <0010> gprs_ns.c:584 NSEI=1800 Tx NS ALIVE_ACK (NSVCI=1800) 20180625042234030 DNS <0010> gprs_ns.c:610 NSEI=1800 Starting timer in mode tns-test (30 seconds) 20180625042234032 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042238087 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042244032 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042244090 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042244619 DLGSUP <0027> gsup_client.c:244 GSUP ping callback (connected, got PONG) 20180625042244619 DLGSUP <0027> gsup_client.c:264 GSUP sending PING 20180625042244619 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042244619 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042244619 DLINP <001f> input/ipa.c:142 127.0.0.1:4222 connected write 20180625042244619 DLINP <001f> input/ipa.c:92 127.0.0.1:4222 sending data 20180625042244620 DLINP <001f> input/ipa.c:138 127.0.0.1:4222 connected read 20180625042244620 DLINP <001f> input/ipa.c:56 127.0.0.1:4222 message received 20180625042244620 DLGSUP <0027> gsup_client.c:201 GSUP receiving PONG 20180625042250092 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042254032 DBSSGP <0011> gprs_bssgp.c:806 BSSGP BVCI=1800 Rx Flow Control BVC 20180625042254487 DGPRS <000f> gprs_sgsn.c:912 Checking for inactive LLMEs, time = 491 20180625042256094 DMM <0002> gprs_gmm.c:437 MM(xxxxxxxxxxxxxxx/f2d9d8dd) <- GPRS ATTACH ACCEPT (new P-TMSI=0xf2d9d8dd) 20180625042302097 DMM <0002> gprs_gmm.c:2108 MM(xxxxxxxxxxxxxxx/f2d9d8dd) T3350 expired >= 5 times 20180625042302097 DMM <0002> gprs_gmm.c:313 MM(xxxxxxxxxxxxxxx/f2d9d8dd) Cleaning MM context due to T3350 20180625042302304 DBSSGP <0011> gprs_bssgp.c:392 BSSGP TLLI=0xb6ccf813 Rx UPLINK-UNITDATA 20180625042302304 DLLC <0012> gprs_llc.c:526 LLC RX: unknown TLLI 0xb6ccf813, creating LLME on the fly 20180625042302304 DLLC <0012> gprs_llc_parse.c:81 LLC SAPI=1 C U GEA0 IOV-UI=0x000000 FCS=0xe0b181 CMD=UI DATA Thanks, Alexa

5 years, 10 months

1
0
0 0

osmo-pcu build failures on Debian 8.0

by Harald Welte

For quite some time, osmo-pcu has been causing build failures on Debian 8. You can find a build log e.g. at https://build.opensuse.org/package/live_build_log/network:osmocom:nightly/o… The visible sign is that for some reasson there are additional log lines present in the output of our unit tests, like: [ 127s] TBF(TFI=0 TLLI=0xffeeddcc DIR=DL STATE=FLOW EGPRS) downlink acknowledge [ 127s] TBF(TFI=0 TLLI=0xffeeddcc DIR=DL STATE=FLOW EGPRS) Final ACK received. [ 127s] +DL packet loss of IMSI= / TLLI=0xffeeddcc: 0% [ 127s] TBF(TFI=0 TLLI=0xffeeddcc DIR=DL STATE=FLOW EGPRS) changes state from FLOW to WAIT RELEASE [ 127s] TBF(TFI=0 TLLI=0xffeeddcc DIR=DL STATE=WAIT RELEASE EGPRS) starting timer T3193 [release (DL-TBF)] with 0 sec. 0 microsec, cur_fn=0 where the "+" is the unexpected additional line. Does anyone have any information about why that is? I don't see any related changes recently. -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

5 years, 11 months

2
1
0 0

GTP-U support for a UE with multiple bearers (LTE)

by Shashank Prasad

Hi, I just started exploring the GTP-U module (maintained in the kernel) for LTE. In LTE, a UE can be associated with multiple bearers. This implies that an MS IP address can be associated with multiple TEIDs (one for each bearer). Based on browsing the kernel GTP implementation[1], it looks like the GTP-U (maintained in the kernel) can only support 1 TEID per MS IP address. In which case, the GTP implementation, as is, may NOT be usable by LTE modules. Is this a correct interpretation? - Shashank [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/plain/dr…

6 years

2
1
0 0

GTP-U support for a UE with multiple bearers

by Shashank Prasad

Hi, I just started exploring the GTP-U module (maintained in the kernel) for LTE scenarios. In LTE, a UE can be associated with multiple bearers. This implies that an MS IP address can be associated with multiple TEIDs (one for each bearer). Based on browsing the kernel GTP implementation[1], it looks like the GTP-U (maintained in the kernel) can only support 1 TEID per MS IP address. In which case, the GTP implementation, as is, may NOT be usable by LTE modules. Is it an correct interpretation? - Shashank [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/plain/dr…

6 years

1
0
0 0

Save the Date: OsmoCon 2018 on October 18-19, 2018

by Harald Welte

== OsmoCon 2018 == OsmoCon (Osmocom Conference) 2018 is the technical conference for Osmocom users, operators and developers! We are happy to announce the date of OsmoCon 2018. It has been scheduled on October 18 + 19, 2018 and will happen in Berlin, Germany. For the second time, the Osmocom Conference brings together users, operators and developers of the Osmocom Open Source cellular infrastructure projects, such as OsmoBTS, OsmoBSC, OsmoSGSN, OpenGGSN and others. Join us for two days of presentations and discussions with the main developers behind Open Source Mobile Communications, as well as commercial and non-profit users of the Osmocom cellular infrastructure software. You can find some initial information in our wiki at http://osmocom.org/projects/osmo-dev-con/wiki/OsmoCon2018 which will be updated as more information becomes available. == Call for Participation == We're also at the same time announcing the Call for Participation and call on everyone with experiences to share around the Osmocom member projects to submit talks, workshops, discussions or other proposals. You can find the CfP at https://pretalx.sysmocom.de/osmocon2018/cfp We are particularly looking for contributions about: * updates on features/functionality/status of individual Osmocom projects * success stories on how Osmocom projects are deployed in practice * migration from OsmoNITB to the post-NITB architecture * tutorials / workshops on how to setup / analyze Osmocom projects * statistics, reporting, operations aspects of Osmocom projects * third-party open source utilities to be used with Osmocom projects Looking forward to meeting many existing and new Osmocom users at OsmCon this October! Regards, Harald Welte -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

6 years

1
0
0 0

Data throughput issues. Increasing throughput.

by Dave Ellis

Hi, I need to increase the throughput through the GTP tunnels to around 9Gb/s. I have two servers and they are connected using two GTP tunnels over a Mellanox 25Gb/s link. Via the tunnels I am seeing a total of 4.2 Gb/s to 4.5 Gb/s using iPerf. If data is sent without the tunnels I see a throughput of around 24.5Gb/s. I have tried various tweaks to improve the throughput over the GTP tunnels and have only made marginal gains. I have tried iPerf 2.0.9 and iPerf3 and see the same results. Wireshark shows the iPerf MTU is reflected in the pcap logs. I have tried changing the txqueuelen on the tunnels, changing osmo-ggsn niceness, network buffer sizes etc. The restriction seems to be osmo-ggsn as that is taking up to 92% CPU on one of the cores when the throughput tests are running. I'm hoping I have made a mistake in the configuration of OsmoGGSN and sgsnemu. -- The servers are running Ubuntu 16.04 desktop. 16GB RAM - 12.6GB free when running throughput tests. Intel E52620v3. Mellanox MCX516A-CCAT network adapter. 25Gb direct attach copper connecting the two servers OsmoGGSN version 1.1.0.75-3e44-dirty. For one of the servers: - Mellanox interface details ens3f0 Link encap:Ethernet HWaddr ec:0d:9a:a0:1d:7c inet addr:172.16.8.1 Bcast:172.16.255.255 Mask:255.255.0.0 inet6 addr: fe80::8f38:33e3:bd46:dd65/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:9000 Metric:1 RX packets:142373677 errors:0 dropped:0 overruns:0 frame:0 TX packets:157500406 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10000 RX bytes:793825609487 (793.8 GB) TX bytes:879898325287 (879.8 GB) Tunnel interface details S1Utun Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.1.1.2 P-t-P:10.1.1.2 Mask:255.255.255.0 inet6 addr: fe80::b3fc:3d43:b751:bcbf/64 Scope:Link UP POINTOPOINT RUNNING MTU:9000 Metric:1 RX packets:4640412 errors:0 dropped:0 overruns:0 frame:0 TX packets:2272797 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:500 RX bytes:37729672063 (37.7 GB) TX bytes:118866016 (118.8 MB) X2Utun Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.1.2.2 P-t-P:10.1.2.2 Mask:255.255.255.0 inet6 addr: fe80::6ed8:8a79:b3e9:a51d/64 Scope:Link UP POINTOPOINT RUNNING MTU:9000 Metric:1 RX packets:1824011 errors:0 dropped:0 overruns:0 frame:0 TX packets:3856238 errors:0 dropped:4229 overruns:0 carrier:0 collisions:0 txqueuelen:500 RX bytes:95648485 (95.6 MB) TX bytes:31367266755 (31.3 GB) client side iperf server1 iperf3 -c 10.1.2.1 -i1 -t 30 -M8100 -w 2048K -P8 server2 iperf3 -c 10.1.2.1 -i1 -t 30 -M8100 -w 2048K -P8 server1 and 2 iperf server iperf3 -s -i1 osmo-ggsn -c /home/osmo-ggsn.cfg -g 172.16.1.1 contents of osmo-ggsn.cfg ! ! OpenGGSN (0.94.1-adac) configuration saved from vty !! ! log stderr logging filter all 1 logging color 1 logging print category 0 logging timestamp 0 logging level ip info logging level tun info logging level ggsn info logging level sgsn notice logging level icmp6 notice logging level lglobal notice logging level llapd notice logging level linp notice logging level lmux notice logging level lmi notice logging level lmib notice logging level lsms notice logging level lctrl notice logging level lgtp info logging level lstats notice logging level lgsup notice logging level loap notice logging level lss7 notice logging level lsccp notice logging level lsua notice logging level lm3ua notice logging level lmgcp notice ! stats interval 5 ! line vty no login ! ggsn X2Uggsn gtp state-dir /tmp gtp bind-ip 172.16.8.1 gtp gtp0-port 3386 gtp gtp1c-port 2123 gtp gtp1u-port 2153 gtp gtp1uremot-port 2153 apn X2U gtpu-mode tun tun-device X2Utun type-support v4 ip prefix dynamic 10.1.2.0/24 ip dns 0 192.168.100.1 ip dns 1 8.8.8.8 ip ifconfig 10.1.2.2/24 no shutdown default-apn X2U no shutdown ggsn ggsn S1Uggsn gtp state-dir /tmp gtp bind-ip 172.16.8.1 gtp gtp0-port 3387 gtp gtp1c-port 2124 gtp gtp1u-port 2152 gtp gtp1uremot-port 2152 apn S1U gtpu-mode tun tun-device S1Utun type-support v4 ip prefix dynamic 10.1.1.0/24 ip dns 0 192.168.100.1 ip dns 1 8.8.8.8 ip ifconfig 10.1.1.2/24 no shutdown default-apn S1U no shutdown ggsn sgsnemu -l 127.0.0.2 -r 172.16.8.1 --contexts 1 -a S1U -m 4412345678 -q 0x00000000000b921f --defaultroute --pingcount 0 --gtpteid=8 --gtpversion=1 --gsnuip 172.16.1.1 --enduserip 10.1.1.1 --gtp0port 3387 --gtp1cport 2124 --nsapi 1 sgsnemu -l 127.0.0.3 -r 172.16.8.1 --contexts 1 -a X2U -m 4412345678 -q 0x00000000000b921f --defaultroute --pingcount 0 --gtpteid=3 --gtpversion=1 --gsnuip 172.16.1.1 --enduserip 10.1.2.1 --gtp0port 3386 --gtp1cport 2123 --nsapi 2 Hopefully I have provided enough information. Any ideas on how to increase tunnel throughput? Thanks Dave

6 years, 1 month

3
3
0 0

Interfering with the GTP-u Kernel module

by Thomas Boros

Hello, I would like to implement a command line tool, which will be able to open / close , read / write to gtp tunnels. I was able to install the libgtpnl library, but due to lack of documentation I have no idea where to start. Is there some sort of documentation available for this library? I need to be able to create and delete tunnels without the GTP-C communication, so just basic command line tool like create-gtp-tunnel + arguments like IPs, version and teid. The GTP-U tunnels must be kernel based. I have the latest kernel with the gtp kernel module loaded. Any help is appreciated. Thank you, Tomas

6 years, 2 months

2
4
0 0

Problem when building OsmoSGSN

by XINKE ZHANG

Hi all, I built OsmoSGSN with the these following instructions. <build instructions> git clone git://git.osmocom.org/osmo-sgsn cd osmo-sgsn autoreconf -fi ./configure --enable-iu make -j5 make check make install sudo ldconfig <build instructions> And no error came out during building process, but no “osmo-sgsn” executable was found. Pls help me. Thank you in advance. Best Regards, Xinke

6 years, 2 months

4
11
0 0

sgsnemu: no outgoing GTP-U in "createif" mode

by Viktor Tsymbalyuk

Hello, I tried to run sgsnemu in "createif" mode - transfer traffic via tun interface. tun interface created and routing too. But there are no outgoing GTP-U from test machine. (in my scenario sgsnemu on separated server). From gdb it looks, that in cb_tun_ind function ipm->pdp is 0x0, as result gtp_data_req(gsn, ipm->pdp, pack, len); not running. After changes like below, it's start working. Does I correctly understood internal logic? diff --git a/sgsnemu/sgsnemu.c b/sgsnemu/sgsnemu.c index 630733b..cf4aa44 100644 --- a/sgsnemu/sgsnemu.c +++ b/sgsnemu/sgsnemu.c @@ -1462,7 +1462,7 @@ static int create_pdp_conf(struct pdp_t *pdp, void *cbp, int cause) free(forwarding); } - ipset((struct iphash_t *)pdp->peer, &addr); + ipset(iph, &addr); state = 2; /* Connected */ If need more test details, please let me know. -- Viktor

6 years, 2 months

2
1
0 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

osmocom-net-gprs