From 49577b6b5fd3ea1eeb59ed071aa8863306c16429 Mon Sep 17 00:00:00 2001
From: Pedro Alvarez <pedro.alvarez@softwareradiosystems.com>
Date: Wed, 10 Apr 2019 17:45:17 +0100
Subject: [PATCH] Making sure that packet queued in the SPGW is freed when
 queue_downlink_packet enconters errors. Reverse the order of sending paging
 and queueing packet so that paging_pending is properly set to true.

---
 srsepc/src/mme/mme_gtpc.cc |  2 +-
 srsepc/src/spgw/gtpc.cc    | 14 +++++++++-----
 srsepc/src/spgw/gtpu.cc    |  2 +-
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/srsepc/src/mme/mme_gtpc.cc b/srsepc/src/mme/mme_gtpc.cc
index c80d89645..5d0f4b60a 100644
--- a/srsepc/src/mme/mme_gtpc.cc
+++ b/srsepc/src/mme/mme_gtpc.cc
@@ -412,7 +412,7 @@ bool mme_gtpc::send_delete_session_request(uint64_t imsi)
 void mme_gtpc::send_release_access_bearers_request(uint64_t imsi)
 {
   // The GTP-C connection will not be torn down, just the user plane bearers.
-  m_mme_gtpc_log->info("Sending GTP-C Delete Access Bearers Request\n");
+  m_mme_gtpc_log->info("Sending GTP-C Release Access Bearers Request\n");
   srslte::gtpc_pdu    rel_req_pdu;
   srslte::gtp_fteid_t sgw_ctr_fteid;
 
diff --git a/srsepc/src/spgw/gtpc.cc b/srsepc/src/spgw/gtpc.cc
index bf86faef6..3105e9d63 100644
--- a/srsepc/src/spgw/gtpc.cc
+++ b/srsepc/src/spgw/gtpc.cc
@@ -504,12 +504,12 @@ bool spgw::gtpc::queue_downlink_packet(uint32_t ctrl_teid, srslte::byte_buffer_t
   spgw_tunnel_ctx_t* tunnel_ctx;
   if (!m_teid_to_tunnel_ctx.count(ctrl_teid)) {
     m_gtpc_log->error("Could not find GTP context to queue.\n");
-    return false;
+    goto pkt_discard;
   }
   tunnel_ctx = m_teid_to_tunnel_ctx[ctrl_teid];
-  if (tunnel_ctx->paging_pending) {
+  if (!tunnel_ctx->paging_pending) {
     m_gtpc_log->error("Paging not pending. Not queueing packet\n");
-    return false;
+    goto pkt_discard;
   }
 
   if (tunnel_ctx->paging_queue.size() < m_max_paging_queue) {
@@ -519,14 +519,18 @@ bool spgw::gtpc::queue_downlink_packet(uint32_t ctrl_teid, srslte::byte_buffer_t
   } else {
     m_gtpc_log->warning("Paging queue full. IMSI %" PRIu64 ", Packets in Queue %zd\n", tunnel_ctx->imsi,
                         tunnel_ctx->paging_queue.size());
-    m_pool->deallocate(msg);
+    goto pkt_discard;
   }
   return true;
+
+pkt_discard:
+  m_pool->deallocate(msg);
+  return false;
 }
 
 bool spgw::gtpc::free_all_queued_packets(spgw_tunnel_ctx_t* tunnel_ctx)
 {
-  if (tunnel_ctx->paging_pending) {
+  if (!tunnel_ctx->paging_pending) {
     m_gtpc_log->warning("Freeing queue with paging not pending.\n");
   }
 
diff --git a/srsepc/src/spgw/gtpu.cc b/srsepc/src/spgw/gtpu.cc
index 0538fde45..9a3b307b8 100644
--- a/srsepc/src/spgw/gtpu.cc
+++ b/srsepc/src/spgw/gtpu.cc
@@ -247,8 +247,8 @@ void spgw::gtpu::handle_sgi_pdu(srslte::byte_buffer_t* msg)
   } else if (usr_found == false && ctr_found == true) {
     m_gtpu_log->debug("Packet for attached UE that is not ECM connected.\n");
     m_gtpu_log->debug("Triggering Donwlink Notification Requset.\n");
-    m_gtpc->queue_downlink_packet(spgw_teid, msg);
     m_gtpc->send_downlink_data_notification(spgw_teid);
+    m_gtpc->queue_downlink_packet(spgw_teid, msg);
     return;
   } else if (usr_found == false && ctr_found == true) {
     m_gtpu_log->error("User plane tunnel found without a control plane tunnel present.\n");