[Bug]: UPF crash (nil deref in composeFarInfo) on a valid PFCP Session Modification with CreateFAR Outer Header Creation #637

Describe the bug

eUPF (ghcr.io/edgecomllc/eupf:latest) terminates with a nil pointer dereference in composeFarInfo when it handles a valid PFCP Session Modification that adds a downlink Create PDR + Create FAR with Outer Header Creation (GTP-U/IPv4).

This is after a successful Association Setup and Session Establishment (cause=1). The Modification IEs are well-formed. The same Modification is accepted by Open5GS UPF and OAI UPF.

#630 is a nearby bug (Session Establishment, OHC V4 flag set but IPv4 address missing). This report is a valid Modification path, not a truncated OHC on Establishment. #635 (RemoveFAR) and #631 (missing SourceInterface) are different.

To Reproduce

1. Start eUPF. From a PFCP peer, complete Association Setup (cause=1).

2. Send Session Establishment with a normal uplink Create PDR / Create FAR. eUPF returns cause=1 and allocates a UP SEID.

3. Send Session Modification on that UP SEID:

   IE	Content
   Create PDR	Source Interface = Core, UE IPv4, SDF, FAR-ID
   Create FAR	Destination Interface = Access, Apply Action FORW, Outer Header Creation GTP-U/IPv4 toward a gNB address

   No IE is truncated. Description / TEID / IPv4 are all present.

4. Other entries that hit the same composeFarInfo nil deref (same bug, not a second defect):

   • Session Establishment with an extra Create FAR whose OHC IPv4 is 0.0.0.0
   • Update FAR + valid OHC on a session that a real SMF already created

Expected behavior

A valid Session Modification with CreateFAR + Outer Header Creation should install the FAR (or return a PFCP cause if the address is unusable). The process must not panic. composeFarInfo should check that OHC address fields are non-nil before binary.LittleEndian.Uint32.

Logs

panic: runtime error: invalid memory address or nil pointer dereference

github.com/edgecomllc/eupf/cmd/core.composeFarInfo
        .../pfcp_session_handlers.go:588
github.com/edgecomllc/eupf/cmd/core.HandlePfcpSessionModificationRequest.func1
        .../pfcp_session_handlers.go:262

Container exit code 2. SMF is not affected.

Related

• [Bug]UPF crashes on a malformed PFCP Session Establishment Request whose CreateFAR contains Outer Header Creation (OHC) with the IPv4 (V4) flag set but no IPv4Address field present #630 — malformed Estab OHC (V4 set, address missing). Same function, different message.
• [Bug]: UPF FAR global ID 0 overwrite enables cross-session user-plane traffic interception #635 — RemoveFAR / global FAR id 0. Different.
• [Bugs]UPF crash on Heartbeat Request without Recovery Time Stamp #629 — Heartbeat without Recovery Time Stamp. Different.

Happy to send a pcap of the three-message sequence (Association Setup / Session Establishment / Session Modification) privately if useful.