From 9086fb63de1e3c0fa8ae79ccab6652f2a5ee8cfd Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Fri, 3 Oct 2025 10:38:38 +0200 Subject: [PATCH 1/3] Fix memory leak in nr_rrc_ue_process_masterCellGroup - Replace asn1cFreeStruc with ASN_STRUCT_FREE in MAC layer cleanup - Fixes improper memory management of NR_CellGroupConfig structures Root cause: asn1cFreeStruc only calls ASN_STRUCT_RESET + free(), which doesn't properly free nested ASN.1 allocations. ASN_STRUCT_FREE frees all nested structures completely. AddressSanitizer leak trace: Direct leak of 288 byte(s) in 1 object(s) allocated from: /#0 0x7fb72bab4a57 in __interceptor_calloc /#1 0x593752b28d0d in SEQUENCE_decode_uper /#2 0x593752b9a546 in SET_OF_decode_uper /#3 0x593752b2863c in SEQUENCE_decode_uper /#4 0x593752b47363 in CHOICE_decode_uper /#5 0x593752b2863c in SEQUENCE_decode_uper /#6 0x593752b2863c in SEQUENCE_decode_uper /#7 0x593752b2863c in SEQUENCE_decode_uper /#8 0x593752b2863c in SEQUENCE_decode_uper /#9 0x593752b2863c in SEQUENCE_decode_uper /#10 0x593752b38551 in uper_decode /#11 0x5937527d859f in nr_rrc_ue_process_masterCellGroup /#12 0x5937527d9408 in nr_rrc_process_reconfiguration_v1530 /#13 0x5937527dd5bb in nr_rrc_ue_process_rrcReconfiguration /#14 0x5937527f5e6b in nr_rrc_ue_decode_dcch /#15 0x5937527ff003 in rrc_nrue /#16 0x59375280c6de in rrc_nrue_task --- openair2/RRC/NR_UE/L2_interface_ue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair2/RRC/NR_UE/L2_interface_ue.c b/openair2/RRC/NR_UE/L2_interface_ue.c index d6bee2ab10..501510f7d2 100644 --- a/openair2/RRC/NR_UE/L2_interface_ue.c +++ b/openair2/RRC/NR_UE/L2_interface_ue.c @@ -140,7 +140,7 @@ void process_msg_rcc_to_mac(nr_mac_rrc_message_t *msg, int instance_id) break; case NR_MAC_RRC_CONFIG_CG: nr_rrc_mac_config_req_cg(instance_id, 0, msg->payload.config_cg.cellGroupConfig, msg->payload.config_cg.UE_NR_Capability); - asn1cFreeStruc(asn_DEF_NR_CellGroupConfig, msg->payload.config_cg.cellGroupConfig); + ASN_STRUCT_FREE(asn_DEF_NR_CellGroupConfig, msg->payload.config_cg.cellGroupConfig); break; case NR_MAC_RRC_CONFIG_MIB: nr_rrc_mac_config_req_mib(instance_id, From 9639cbb436cbc8364917a87472eead4dde35969c Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Fri, 3 Oct 2025 12:33:03 +0200 Subject: [PATCH 2/3] Fix memory leak in nr_rrc_process_dedicatedNAS_MessageList The leak was caused by improper memory ownership handling in the dedicatedNAS_MessageList processing. The function was transferring buffer ownership to NAS messages and then preventing ASN.1 cleanup from freeing the original allocations by setting list.count = 0, causing a memory leak. Leak trace: Direct leak of 40 byte(s) in 1 object(s) allocated from: /#0 0x7f2ce3ab4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 /#1 0x567907083f0f in OCTET_STRING_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/OCTET_STRING_uper.c:89 /#2 0x5679070ed5e6 in SET_OF_decode_uper /cmake_targets/ran_build/build/openair2/RRC/NR/MESSAGES/constr_SET_OF_uper.c:70 /#3 0x56790707b6dc in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:118 /#4 0x56790707b6dc in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:118 /#5 0x56790709a403 in CHOICE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:84 /#6 0x56790707b6dc in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:118 /#7 0x56790709a403 in CHOICE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:84 /#8 0x56790709a403 in CHOICE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:84 /#9 0x56790707b6dc in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:118 /#10 0x56790708b5f1 in uper_decode /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_decoder.c:83 /#11 0x567906d44b4b in nr_rrc_ue_decode_dcch /openair2/RRC/NR_UE/rrc_UE.c:2212 /#12 0x567906d520a3 in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:2615 /#13 0x567906d5f77e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:2501 /#14 0x7f2ce2494ac2 in start_thread nptl/pthread_create.c:442 Fix: - Copy OCTET_STRING data instead of transferring ownership - Allow ASN.1 cleanup to properly free original allocations This fixes the leak that occurred during rrcReconfiguration message processing when dedicatedNAS_MessageList was present. Closes #828 --- openair2/RRC/NR_UE/rrc_UE.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/openair2/RRC/NR_UE/rrc_UE.c b/openair2/RRC/NR_UE/rrc_UE.c index c167982859..217ca85be7 100644 --- a/openair2/RRC/NR_UE/rrc_UE.c +++ b/openair2/RRC/NR_UE/rrc_UE.c @@ -607,10 +607,10 @@ static void nr_rrc_process_dedicatedNAS_MessageList(NR_UE_RRC_INST_t *rrc, NR_RR nas_establish_cnf_t *msg = &NAS_CONN_ESTABLI_CNF(ittiMsg); msg->errCode = AS_SUCCESS; msg->nasMsg.length = tmp->list.array[i]->size; - msg->nasMsg.nas_data = tmp->list.array[i]->buf; + msg->nasMsg.nas_data = malloc_or_fail(msg->nasMsg.length); + memcpy(msg->nasMsg.nas_data, tmp->list.array[i]->buf, msg->nasMsg.length); itti_send_msg_to_task(TASK_NAS_NRUE, rrc->ue_id, ittiMsg); } - tmp->list.count = 0; // to prevent the automatic free by ASN1_FREE } } From d6047cd83dbe26997dc0a307467617b7d3bccdfc Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Fri, 3 Oct 2025 10:54:43 +0200 Subject: [PATCH 3/3] Fix memory leak in dlInformationTransfer case - Remove unnecessary NULL assignment for dedicatedNAS_Message->buf - The original buffer is copied and transfered to NAS, so it can be properly freed by ASN.1 structure cleanup Root cause: Code was nullifying dedicatedNAS_Message->buf pointer before ASN.1 cleanup could free the original allocation, causing the leak from OCTET_STRING_decode_uper. AddressSanitizer leak trace (FIXED): Direct leak of 119 byte(s) in 3 object(s) allocated from: /#0 0x7ec2a42b4c38 in __interceptor_realloc /#1 0x555fade852e0 in OCTET_STRING_decode_uper /#9 0x555fadb48b11 in nr_rrc_ue_decode_dcch. --- openair2/RRC/NR_UE/rrc_UE.c | 1 - 1 file changed, 1 deletion(-) diff --git a/openair2/RRC/NR_UE/rrc_UE.c b/openair2/RRC/NR_UE/rrc_UE.c index 217ca85be7..2801aacce7 100644 --- a/openair2/RRC/NR_UE/rrc_UE.c +++ b/openair2/RRC/NR_UE/rrc_UE.c @@ -2299,7 +2299,6 @@ static int nr_rrc_ue_decode_dcch(NR_UE_RRC_INST_t *rrc, msg->nasMsg.nas_data = malloc(msg->nasMsg.length); memcpy(msg->nasMsg.nas_data, dedicatedNAS_Message->buf, msg->nasMsg.length); itti_send_msg_to_task(TASK_NAS_NRUE, rrc->ue_id, ittiMsg); - dedicatedNAS_Message->buf = NULL; // to keep the buffer, up to NAS to free it } } } break;