Submit #808794: Dotouch XproUPF v2.0.0-release-088aa7c4 Denial of Service

# Title
UPF Denial of Service via Abnormal Duplicate PDR Accumulation in a Single Session
# Description

A crash was observed in the UPF process during PFCP session handling. The log shows system error type [Aborted] together with a stack trace involving upf_plugin.so, indicating that the UPF process terminated abnormally and entered a crash state. The affected sample version in the log is XproUPF v2.0.0-release-088aa7c4.

In the same log, the session state shows clear abnormal accumulation of duplicate PDR entries within a single PFCP session. Under show upf session, PDR: 3 appears repeatedly many times in the same session instead of being cleanly replaced or removed. These duplicated entries share the same Precedence: 63, the same FAR Id: 1, and the same matching fields, which strongly suggests that the UPF has a flaw in PDR lifecycle handling, such as incorrect update, replacement, or deletion behavior.

The control-plane statistics further show that multiple PFCP requests were successfully received and processed before the crash. The counters for good message receive, good request receive, and sent response accpet all reached 26, indicating that the issue was triggered during repeated PFCP rule processing rather than by a simple network or interface failure.

# Steps to Reproduce
Start the affected UPF version and establish a normal PFCP session. In the captured log, the affected session is shown with CP F-SEID: 0x000000000000d95a and UP F-SEID: 0x0000000000000001.
Repeatedly send PFCP requests that modify PDR-related state for the same session, so that the UPF keeps processing PDR operations for an existing session. The log indicates that this happened multiple times before the crash, with 26 successfully received and accepted requests.
Inspect the session state using show upf session. If the issue is triggered, duplicate PDR entries begin to accumulate abnormally inside the same session. In the captured case, PDR: 3 appears many times instead of existing as a single consistent entry.
Continue the repeated PDR-related PFCP operations until the UPF process aborts. The crash is observable in the log as system error type [Aborted] with a libc abort path and plugin stack trace.
# Log
```
```
=======upf collect information list===========
1. process memory heap statck info
2. show upf version
3. show error verbose
4. show ip neighbor
5. show upf flowtable
6. show buffers
7. show hardware-interfaces detail
8. show upf session
=======system error type [Aborted]==========
trace code function and code line by system cmdline, example:
addr2line -C -f -e /usr/xpro/upf/tools/plugins/upf_plugin.so 0x2e34a9
/usr/xpro/upf/tools/plugins/upf_plugin.so(+0x110659)[0x7f2164a60659]
/lib64/libc.so.6(+0x35270)[0x7f22ea22a270]
/lib64/libc.so.6(gsignal+0x37)[0x7f22ea22a1f7]
/lib64/libc.so.6(abort+0x148)[0x7f22ea22b8e8]
/usr/xpro/upf/tools/plugins/upf_plugin.so(+0x1805e2)[0x7f2164ad05e2]
/usr/xpro/upf/tools/plugins/upf_plugin.so(+0x18d27a)[0x7f2164add27a]
/usr/xpro/upf/tools/plugins/upf_plugin.so(+0x1a5f35)[0x7f2164af5f35]
/usr/xpro/upf/tools/plugins/upf_plugin.so(+0x1a6a18)[0x7f2164af6a18]
/usr/xpro/upf/tools/plugins/upf_plugin.so(+0x1a70c4)[0x7f2164af70c4]
/usr/xpro/upf/tools/plugins/upf_plugin.so(+0x128364)[0x7f2164a78364]
/usr/xpro/upf/tools/libs/libvlib.so.21.01(+0x8eaab)[0x7f22ec99eaab]
/usr/xpro/upf/tools/libs/libvlib.so.21.01(vlib_worker_loop+0x7a7)[0x7f22ec9a42f7]
/usr/xpro/upf/tools/libs/libvppinfra.so.21.01(+0x57780)[0x7f22ec8d3780]
=======END==========
=======show upf version==========
dtupf v2.0.0-release-088aa7c4 built by root on localhost.localdomain at 2025-03-21 09:27:50
=======END==========
=======show error verbose==========
Count Node Reason
Thread 0 (vpp_main�):
Thread 1 (vpp_wk_0�):
26 upf4-drvoutput good packets transmit
26 upf4-drvoutput good pfcp packets transmit
26 upf-pfcp4-input good message receive
26 upf-pfcp4-input good request receive
26 upf-pfcp4-input sent response accpet
Thread 2 (vpp_wk_1�):
27 upf-pfcp4-drvinput good packets receive
27 upf-pfcp4-drvinput dispatch packets to process succ
2 arp-reply ARP replies sent
1 arp-reply IP4 source address not local to subnet
54 arp-disabled ARP Disabled on this interface
Thread 3 (vpp_wk_2�):
Thread 4 (vpp_wk_3�):
Thread 5 (vpp_wk_4�):
Total:
26 upf4-drvoutput good packets transmit
26 upf4-drvoutput good pfcp packets transmit
26 upf-pfcp4-input good message receive
26 upf-pfcp4-input good request receive
26 upf-pfcp4-input sent response accpet
27 upf-pfcp4-drvinput good packets receive
27 upf-pfcp4-drvinput dispatch packets to process succ
2 arp-reply ARP replies sent
1 arp-reply IP4 source address not local to subnet
54 arp-disabled ARP Disabled on this interface
=======END==========
=======show ip neighbor ==========
Time IP Flags Ethernet Interface
6.6282 x.x.x.x S 00:0c:29:54:74:86 UPF1
37.9897 x.x.x.x D 00:0c:29:54:74:86 UPF1
=======END==========
=======show upf flowtable==========
thread_3, n3n6_flows: 0, 5gvn_flows: 0
upf index: n3n6 0 flowsmax_per_upf:512 flowsmax_per_cpu: 512 flows_cur_cpu: 0
upf index: 5gvn 0 flowsmax_per_upf:512 flowsmax_per_cpu: 512 flows_cur_cpu: 0
=======END==========
=======show buffers==========
Pool Name Index NUMA Size Data Size Total Avail Cached Used
default-numa-0 0 0 2496 2048 430185 423433 113 6639
=======END==========
=======show hardware-interfaces detail==========
Name Idx Link Hardware
UPF1 1 up UPF1
Link speed: 1 Gbps
Ethernet address 00:0c:29:73:9c:3d
Intel 82540EM (e1000)
carrier up full duplex mtu 9206
flags: admin-up pmd maybe-multiseg tx-offload intel-phdr-cksum rx-ip4-cksum
Devargs:
rx: queues 1 (max 1), desc 2048 (min 32 max 4096 align 8)
tx: queues 1 (max 1), desc 2048 (min 32 max 4096 align 8)
pci: device 8086:10d3 subsystem 15ad:07d0 address 0000:0b:00.00 numa 0
module: unknown
max rx packet len: 9234
promiscuous: unicast off all-multicast on
vlan offload: strip off filter off qinq off
rx offload avail: vlan-strip ipv4-cksum udp-cksum tcp-cksum vlan-filter
jumbo-frame scatter keep-crc
rx offload active: ipv4-cksum jumbo-frame scatter
tx offload avail: vlan-insert ipv4-cksum udp-cksum tcp-cksum multi-segs
tx offload active: udp-cksum tcp-cksum multi-segs
rss avail: none
rss active: none
tx burst function: eth_em_xmit_pkts
rx burst function: eth_em_recv_scattered_pkts

tx frames ok 52
tx bytes ok 3287
rx frames ok 30
rx bytes ok 5135
extended stats:
rx_good_packets 30
tx_good_packets 52
rx_good_bytes 5135
tx_good_bytes 3287
rx_missed_errors 0
rx_errors 0
tx_errors 0
rx_mbuf_allocation_errors 0
rx_q0_packets 0
rx_q0_bytes 0
rx_q0_errors 0
tx_q0_packets 0
tx_q0_bytes 0
UPF2 2 up UPF2
Link speed: 1 Gbps
Ethernet address 00:0c:29:73:9c:47
Intel 82540EM (e1000)
carrier up full duplex mtu 9206
flags: admin-up pmd maybe-multiseg tx-offload intel-phdr-cksum rx-ip4-cksum
Devargs:
rx: queues 1 (max 1), desc 2048 (min 32 max 4096 align 8)
tx: queues 1 (max 1), desc 2048 (min 32 max 4096 align 8)
pci: device 8086:10d3 subsystem 15ad:07d0 address 0000:13:00.00 numa 0
module: unknown
max rx packet len: 9234
promiscuous: unicast off all-multicast on
vlan offload: strip off filter off qinq off
rx offload avail: vlan-strip ipv4-cksum udp-cksum tcp-cksum vlan-filter
jumbo-frame scatter keep-crc
rx offload active: ipv4-cksum jumbo-frame scatter
tx offload avail: vlan-insert ipv4-cksum udp-cksum tcp-cksum multi-segs
tx offload active: udp-cksum tcp-cksum multi-segs
rss avail: none
rss active: none
tx burst function: eth_em_xmit_pkts
rx burst function: eth_em_recv_scattered_pkts

rx frames ok 27
rx bytes ok 1728
extended s

• User: ZiyuLin (UID 93568)
• Submission: 04/21/2026 10:16 (3 months ago)
• Moderation: 05/09/2026 11:29 (18 days later)
• Status: Accepted
• VulDB entry: 362449 [Dotouch XproUPF 2.0.0-release-088aa7c4 UPF Process libvlib.so vlib_worker_loop denial of service]
• Points: 17