maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Handle GTP receiver errors

Browse Source 
On error, exit the GTP thread after printing a diagnostic message. This
avoids also an error flagged by address sanitizer for use-after-free.

    [GTPU]   [91] Recvfrom failed (Bad file descriptor)
    =================================================================
    ==285377==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cd7b7fe5590 at pc 0x0000006a9e18 bp 0x7b97ad4e1d50 sp 0x7b97ad4e1d48
    READ of size 4 at 0x7cd7b7fe5590 thread T8

    =================================================================
    ==285377==ERROR: LeakSanitizer: detected memory leaks

    Direct leak of 160 byte(s) in 1 object(s) allocated from:
        #0 0x0000006a9e17 in gtpv1uReceiver /home/richie/oai/openair3/ocp-gtpu/gtp_itf.cpp:1346
        #1 0x7f97b9a28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f)
        #2 0x7f97b8e7ff53 in start_thread (/lib64/libc.so.6+0x71f53) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317)
        #3 0x7f97b8f0332b in __clone3 (/lib64/libc.so.6+0xf532b) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317)

        #0 0x7f97b9ae60cb in memalign (/lib64/libasan.so.8+0xe60cb) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f)
        #1 0x000000471039 in newNotifiedFIFO_elt /home/richie/oai/common/utils/threadPool/notified_fifo.h:75
        #2 0x000000471039 in tx_func /home/richie/oai/executables/nr-gnb.c:107
        #3 0x000000471039 in L1_tx_thread /home/richie/oai/executables/nr-gnb.c:167
        #4 0x7f97b9a28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f)

    0x7cd7b7fe5590 is located 336 bytes inside of 400-byte region [0x7cd7b7fe5440,0x7cd7b7fe55d0)
    freed by thread T0 here:
    SUMMARY: AddressSanitizer: 160 byte(s) leaked in 1 allocation(s).
This commit is contained in:
Robert Schmidt
2025-10-27 16:49:16 +01:00
parent 75a68167ea
commit b67c639688
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openair3/ocp-gtpu/gtp_itf.cpp
+7 -7
View File
@@ -1283,7 +1283,7 @@ static int Gtpv1uHandleGpdu(int h, uint8_t *msgBuf, uint32_t msgBufLen, const st
return !GTPNOK;
}
static void gtpv1uReceiveHandleMessage(int h)
static bool gtpv1uReceiveHandleMessage(int h)
{
uint8_t udpData[65536];
int udpDataLen;
@@ -1293,19 +1293,19 @@ static void gtpv1uReceiveHandleMessage(int h)
if ((udpDataLen = recvfrom(h, udpData, sizeof(udpData), 0, (struct sockaddr *)&addr, &from_len)) < 0) {
LOG_E(GTPU, "[%d] Recvfrom failed (%s)\n", h, strerror(errno));
return;
return false;
} else if (udpDataLen == 0) {
LOG_W(GTPU, "[%d] Recvfrom returned 0\n", h);
return;
return true;
} else {
if (udpDataLen < (int)sizeof(Gtpv1uMsgHeaderT)) {
LOG_W(GTPU, "[%d] received malformed gtp packet \n", h);
return;
return true;
}
Gtpv1uMsgHeaderT *msg = (Gtpv1uMsgHeaderT *)udpData;
if ((int)(ntohs(msg->msgLength) + sizeof(Gtpv1uMsgHeaderT)) != udpDataLen) {
LOG_W(GTPU, "[%d] received malformed gtp packet length\n", h);
return;
return true;
}
LOG_D(GTPU, "[%d] Received GTP data, msg type: %x\n", h, msg->msgType);
switch (msg->msgType) {
@@ -1337,13 +1337,13 @@ static void gtpv1uReceiveHandleMessage(int h)
break;
}
}
return true;
}
static void* gtpv1uReceiver(void *thr)
{
gtpThread_t *gt = (gtpThread_t *)thr;
while (true) {
gtpv1uReceiveHandleMessage(gt->h);
while (gtpv1uReceiveHandleMessage(gt->h)) {
}
LOG_W(GTPU, "exiting thread\n");
return NULL;