From 0ef6153bb9a67e2277e9ba417d9f5fbed9ac9019 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Fri, 16 Aug 2024 13:35:04 +0200 Subject: [PATCH 1/4] Fix memory leak of NAS buffer transfered to RRC with NAS_UPLINK_DATA_REQ * Data buffer for NAS Registration Complete and Authentication Response is malloced in the NAS thread and transfered with ITTI message to RRC, where needs to be freed Direct leak of 24 byte(s) in 1 object(s) allocated from: >0 0x7ffff74b4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 >1 0x5555572b0607 in generateAuthenticationResp /repo/openairinterface5g/develop/openair3/NAS/NR_UE/nr_nas_msg_sim.c:608 >2 0x5555572b0607 in nas_nrue /repo/openairinterface5g/develop/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1402 >3 0x5555572baef6 in nas_nrue_task /repo/openairinterface5g/develop/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1198 >4 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442 Direct leak of 10 byte(s) in 1 object(s) allocated from: >0 0x7ffff74b4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 >1 0x55555729754e in generateRegistrationComplete /repo/openairinterface5g/develop/openair3/NAS/NR_UE/nr_nas_msg_sim.c:782 >2 0x555557299ad3 in handle_registration_accept /repo/openairinterface5g/develop/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1212 >3 0x5555572b06a0 in nas_nrue /repo/openairinterface5g/develop/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1411 >4 0x5555572baef6 in nas_nrue_task /repo/openairinterface5g/develop/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1198 >5 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442 --- openair2/RRC/NR_UE/rrc_UE.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair2/RRC/NR_UE/rrc_UE.c b/openair2/RRC/NR_UE/rrc_UE.c index eb5113ccee..327f4fcf7b 100644 --- a/openair2/RRC/NR_UE/rrc_UE.c +++ b/openair2/RRC/NR_UE/rrc_UE.c @@ -1823,6 +1823,7 @@ void *rrc_nrue(void *notUsed) // error: the remote gNB is hardcoded here rb_id_t srb_id = rrc->Srb[2] == RB_ESTABLISHED ? 2 : 1; nr_pdcp_data_req_srb(rrc->ue_id, srb_id, 0, length, buffer, deliver_pdu_srb_rlc, NULL); + free(req->nasMsg.data); free(buffer); break; } From 8e9f6385cc481529bb27803c6feb7eafdf46012a Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Fri, 30 Aug 2024 14:57:45 +0200 Subject: [PATCH 2/4] Fix memory leak in generateAuthenticationResp > Direct leak of 16 byte(s) in 1 object(s) allocated from: >0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 >1 0x55555818ef1c in generateAuthenticationResp /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:588 >2 0x5555581b0fca in nas_nrue /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1405 >3 0x5555581a3069 in nas_nrue_task /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1213 >4 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442 --- openair3/NAS/NR_UE/nr_nas_msg_sim.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openair3/NAS/NR_UE/nr_nas_msg_sim.c b/openair3/NAS/NR_UE/nr_nas_msg_sim.c index 0baab7b65c..aedcf71cbc 100644 --- a/openair3/NAS/NR_UE/nr_nas_msg_sim.c +++ b/openair3/NAS/NR_UE/nr_nas_msg_sim.c @@ -614,6 +614,8 @@ static void generateAuthenticationResp(nr_ue_nas_t *nas, as_nas_info_t *initialN initialNasMsg->data = (Byte_t *)malloc(size * sizeof(Byte_t)); initialNasMsg->length = mm_msg_encode(mm_msg, (uint8_t *)(initialNasMsg->data), size); + // Free res value after encode + free(res.value); } int nas_itti_kgnb_refresh_req(instance_t instance, const uint8_t kgnb[32]) From 0265607a9523972e51035a71be619a149c57456a Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Fri, 30 Aug 2024 15:01:45 +0200 Subject: [PATCH 3/4] Fix memory leaks in NAS generatePduSessionEstablishRequest >Direct leak of 7 byte(s) in 1 object(s) allocated from: >0 0x7ffff74b4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 >1 0x55555819ab3c in generatePduSessionEstablishRequest /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:938 >2 0x5555581a8a9f in nas_nrue /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1295 >3 0x5555581a3078 in nas_nrue_task /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1215 >4 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442 > Direct leak of 4 byte(s) in 1 object(s) allocated from: >0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 >1 0x55555819c025 in generatePduSessionEstablishRequest /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:993 >2 0x5555581a8a9f in nas_nrue /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1295 >3 0x5555581a3078 in nas_nrue_task /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1215 >4 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442 > Direct leak of 1 byte(s) in 1 object(s) allocated from: >0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 >1 0x55555819c8f7 in generatePduSessionEstablishRequest /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:987 >2 0x5555581a9b75 in nas_nrue /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1299 >3 0x5555581a414e in nas_nrue_task /home/guido/repo/openairinterface5g/fix-ue-memory-leaks/openair3/NAS/NR_UE/nr_nas_msg_sim.c:1219 >4 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442 --- openair3/NAS/NR_UE/nr_nas_msg_sim.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/openair3/NAS/NR_UE/nr_nas_msg_sim.c b/openair3/NAS/NR_UE/nr_nas_msg_sim.c index aedcf71cbc..7c9f7642cc 100644 --- a/openair3/NAS/NR_UE/nr_nas_msg_sim.c +++ b/openair3/NAS/NR_UE/nr_nas_msg_sim.c @@ -1004,6 +1004,11 @@ static void generatePduSessionEstablishRequest(nr_ue_nas_t *nas, as_nas_info_t * security_header_len + mm_msg_encode(mm_msg, (uint8_t *)(initialNasMsg->data + security_header_len), size - security_header_len); + // Free allocated memory after encode + free(req_buffer); + free(mm_msg->uplink_nas_transport.dnn.value); + free(mm_msg->uplink_nas_transport.snssai.value); + /* ciphering */ uint8_t buf[initialNasMsg->length - 7]; stream_cipher.context = nas->security_container->ciphering_context; From 47833b1aebe76817bd83712fc5ee95590e28c87a Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Fri, 30 Aug 2024 15:04:08 +0200 Subject: [PATCH 4/4] Free NAS PDU buffer in NAS task, which has ownership --- openair3/NAS/NR_UE/nr_nas_msg_sim.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/openair3/NAS/NR_UE/nr_nas_msg_sim.c b/openair3/NAS/NR_UE/nr_nas_msg_sim.c index 7c9f7642cc..c942e079cd 100644 --- a/openair3/NAS/NR_UE/nr_nas_msg_sim.c +++ b/openair3/NAS/NR_UE/nr_nas_msg_sim.c @@ -1330,6 +1330,8 @@ void *nas_nrue(void *args_p) capture_pdu_session_establishment_accept_msg(pdu_buffer, pdu_length); } + // Free NAS buffer memory after use (coming from RRC) + free(pdu_buffer); break; } @@ -1454,6 +1456,8 @@ void *nas_nrue(void *args_p) LOG_W(NR_RRC, "unknown message type %d\n", msg_type); break; } + // Free NAS buffer memory after use (coming from RRC) + free(pdu_buffer); if (initialNasMsg.length > 0) send_nas_uplink_data_req(nas, &initialNasMsg);