From c78b8dda5611cdb639c24a5f2ef13f71325a6ea6 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Wed, 24 Jul 2024 10:29:02 +0200 Subject: [PATCH 1/2] Fix memory leak in PDU Session Setup Request * fill_DRB_configList_e1 is filling `DRB_configList->list` then passing to PDCP * the contents of the struct are allocated but seem not to be freed * the following mem leak was detected by ASAN ``` Direct leak of 32 byte(s) in 1 object(s) allocated from: *0 0x7ffff74b4c38 in __interceptor_realloc /src/libsanitizer/asan/asan_malloc_linux.cpp:164 *1 0x55555caa6a3e in asn_set_add /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/asn_SET_OF.c:27 *2 0x55555c8b8bb6 in fill_DRB_configList_e1 /openair2/LAYER2/nr_pdcp/cucp_cuup_handler.c:42 *3 0x55555c8be6eb in e1_bearer_context_setup /openair2/LAYER2/nr_pdcp/cucp_cuup_handler.c:189 *4 0x55555d329668 in cucp_cuup_bearer_context_setup_direct /openair2/RRC/NR/cucp_cuup_direct.c:31 *5 0x55555b9a2c37 in trigger_bearer_setup /openair2/RRC/NR/rrc_gNB_NGAP.c:437 *6 0x55555b9b54bf in rrc_gNB_process_NGAP_PDUSESSION_SETUP_REQ /openair2/RRC/NR/rrc_gNB_NGAP.c:830 *7 0x55555b936871 in rrc_gnb_task /openair2/RRC/NR/rrc_gNB.c:2428 *8 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442 ``` * using ASN_STRUCT_RESET to free the memory used by the members of the structure without freeing the structure pointer which is allocated on the stack --- openair2/LAYER2/nr_pdcp/cucp_cuup_handler.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair2/LAYER2/nr_pdcp/cucp_cuup_handler.c b/openair2/LAYER2/nr_pdcp/cucp_cuup_handler.c index 414edb052b..0cccdbcb6c 100644 --- a/openair2/LAYER2/nr_pdcp/cucp_cuup_handler.c +++ b/openair2/LAYER2/nr_pdcp/cucp_cuup_handler.c @@ -196,6 +196,7 @@ void e1_bearer_context_setup(const e1ap_bearer_setup_req_t *req) cu_up_ue_id, &DRB_configList, &security_parameters); + ASN_STRUCT_RESET(asn_DEF_NR_DRB_ToAddModList, &DRB_configList.list); if (f1inst >= 0) { /* we have F1(-U) */ teid_t dummy_teid = 0xffff; // we will update later with answer from DU in_addr_t dummy_address = {0}; // IPv4, updated later with answer from DU From 2d6aef51837b183cb6f8bfe0d6de18047a06601a Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Wed, 24 Jul 2024 10:41:46 +0200 Subject: [PATCH 2/2] Fix memory leak in PDU Session Setup Request decoding * aper_decode allocates memory for for local pointer `pdusessionTransfer`, in `decodePDUSessionResourceSetup` * this memory seems not to be freed but its members are by: `ASN_STRUCT_FREE_CONTENTS_ONLY(asn_DEF_NGAP_PDUSessionResourceSetupRequestTransfer,pdusessionTransfer);` which btw in its header says: "AVOID using it in the application code; Use a safer ASN_STRUCT_RESET() instead" * the following mem leak was detected by ASAN: ``` Direct leak of 72 byte(s) in 1 object(s) allocated from: *0 0x7ffff74b4a57 in __interceptor_calloc /src/libsanitizer/asan/asan_malloc_linux.cpp:154 *1 0x55555cb306df in SEQUENCE_decode_aper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_aper.c:36 *2 0x55555ca9fa28 in aper_decode /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/aper_decoder.c:78 *3 0x55555b99bae6 in decodePDUSessionResourceSetup /openair2/RRC/NR/rrc_gNB_NGAP.c:273 *4 0x55555b99fec2 in trigger_bearer_setup /openair2/RRC/NR/rrc_gNB_NGAP.c:357 *5 0x55555b9b54bf in rrc_gNB_process_NGAP_PDUSESSION_SETUP_REQ /openair2/RRC/NR/rrc_gNB_NGAP.c:830 *6 0x55555b936871 in rrc_gnb_task /openair2/RRC/NR/rrc_gNB.c:2428 *7 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442 ``` * This commit replaces ASN_STRUCT_FREE_CONTENTS_ONLY with ASN_STRUCT_FREE, which will free the memory allocated for the entire struct and its members --- openair2/RRC/NR/rrc_gNB_NGAP.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair2/RRC/NR/rrc_gNB_NGAP.c b/openair2/RRC/NR/rrc_gNB_NGAP.c index e1395ce6cd..dc69091383 100644 --- a/openair2/RRC/NR/rrc_gNB_NGAP.c +++ b/openair2/RRC/NR/rrc_gNB_NGAP.c @@ -335,7 +335,7 @@ static int decodePDUSessionResourceSetup(pdusession_t *session) return -1; } } - ASN_STRUCT_FREE_CONTENTS_ONLY(asn_DEF_NGAP_PDUSessionResourceSetupRequestTransfer,pdusessionTransfer ); + ASN_STRUCT_FREE(asn_DEF_NGAP_PDUSessionResourceSetupRequestTransfer, pdusessionTransfer); return 0; }