SMF crash with segmentation violation when no specificPath defined

I have a free5gc core v3.0.6 installed as docker-compose with gNB and UE (UERANSIM v3.2.5) running in separate VMs with an access connectivity to core.

SMF defines both default routes (links:) and specific routes (ueRoutingInfo:) which is working properly.

However, when I remove specificPath: from ueRoutingInfo: then SMF crashes when I create PDU session for a UE that has a specific route.

I can see that it is an optional attribute (config.go):

SpecificPaths []SpecificPath `yaml:"specificPath,omitempty"`

Please find SMF uerouting configuration:

info:
  version: 1.0.1
  description: Routing information for UE

ueRoutingInfo: # the list of UE routing information
  UE-gNB-1-1: # Group Name
    members:
    - imsi-208930000000002 # Subscription Permanent Identifier of the UE
    - imsi-208930000000001 # Subscription Permanent Identifier of the UE
    topology:
    # Network topology for this group (Uplink: A->B, Downlink: B->A)
    # default path derived from this topology
    # node name should be consistent with smfcfg.yaml
      - A: gNB1
        B: UPF-R1
      - A: UPF-R1
        B: UPF-T1

Please find corresponding SMF logs:

smf       | 2021-12-22T11:15:23Z [INFO][SMF][App] SMF version:
smf       |     free5GC version: v3.0.6
smf       |     build time:      2021-12-19T13:22:19Z
smf       |     commit hash:     46644f0a
smf       |     commit time:     2021-09-13T13:23:12Z
smf       |     go version:      go1.14.4 linux/amd64
smf       | 2021-12-22T11:15:23Z [INFO][SMF][Init] SMF Log level is set to [debug] level
...
smf       | 2021-12-22T11:16:08Z [DEBU][LIB][Aper] Field "IEExtensions" in ngapType.PDUSessionResourceSetupResponseTransfer is OPTIONAL and not present (aper.go:829)
smf       | 2021-12-22T11:16:08Z [INFO][SMF][PFCP] In HandlePfcpSessionModificationResponse
smf       | 2021-12-22T11:16:08Z [INFO][SMF][PduSess] [SMF] PFCP Modification Resonse Accept
smf       | 2021-12-22T11:16:08Z [INFO][LIB][PFCP] Remove Request Transaction [12]
smf       | 2021-12-22T11:16:08Z [INFO][SMF][PFCP] Add PSAAndULCL
smf       | panic: runtime error: invalid memory address or nil pointer dereference
smf       | [signal SIGSEGV: segmentation violation code=0x1 addr=0x40 pc=0xb3433b]
smf       |
smf       | goroutine 463 [running]:
smf       | github.com/free5gc/smf/context.(*SMContext).AllocateLocalSEIDForDataPath(0xc000076600, 0x0)
smf       |     /go/src/free5gc/NFs/smf/context/sm_context.go:309 +0x8b
smf       | github.com/free5gc/smf/producer.AddPDUSessionAnchorAndULCL(0xc000076600, 0x2, 0xc000022d40, 0x12, 0x20)
smf       |     /go/src/free5gc/NFs/smf/producer/ulcl_procedure.go:23 +0x2c5
smf       | github.com/free5gc/smf/pfcp/handler.HandlePfcpSessionModificationResponse(0xc0001ad180)
smf       |     /go/src/free5gc/NFs/smf/pfcp/handler/handler.go:248 +0x6c4
smf       | github.com/free5gc/smf/pfcp.Dispatch(0xc0001ad180)
smf       |     /go/src/free5gc/NFs/smf/pfcp/dispatcher.go:45 +0x48a
smf       | created by github.com/free5gc/smf/pfcp/udp.Run.func1
smf       |     /go/src/free5gc/NFs/smf/pfcp/udp/udp.go:44 +0x1d1
smf exited with code 2

Thanks.

free5gc / smf

SMF crash with segmentation violation when no specificPath defined #39