From b67c6396882e08fa0865f4902bdfa60aa58e9982 Mon Sep 17 00:00:00 2001
From: Robert Schmidt <robert.schmidt@openairinterface.org>
Date: Mon, 27 Oct 2025 16:47:24 +0100
Subject: [PATCH] Handle GTP receiver errors

On error, exit the GTP thread after printing a diagnostic message. This
avoids also an error flagged by address sanitizer for use-after-free.

    [GTPU]   [91] Recvfrom failed (Bad file descriptor)
    =================================================================
    ==285377==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cd7b7fe5590 at pc 0x0000006a9e18 bp 0x7b97ad4e1d50 sp 0x7b97ad4e1d48
    READ of size 4 at 0x7cd7b7fe5590 thread T8

    =================================================================
    ==285377==ERROR: LeakSanitizer: detected memory leaks

    Direct leak of 160 byte(s) in 1 object(s) allocated from:
        #0 0x0000006a9e17 in gtpv1uReceiver /home/richie/oai/openair3/ocp-gtpu/gtp_itf.cpp:1346
        #1 0x7f97b9a28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f)
        #2 0x7f97b8e7ff53 in start_thread (/lib64/libc.so.6+0x71f53) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317)
        #3 0x7f97b8f0332b in __clone3 (/lib64/libc.so.6+0xf532b) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317)

        #0 0x7f97b9ae60cb in memalign (/lib64/libasan.so.8+0xe60cb) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f)
        #1 0x000000471039 in newNotifiedFIFO_elt /home/richie/oai/common/utils/threadPool/notified_fifo.h:75
        #2 0x000000471039 in tx_func /home/richie/oai/executables/nr-gnb.c:107
        #3 0x000000471039 in L1_tx_thread /home/richie/oai/executables/nr-gnb.c:167
        #4 0x7f97b9a28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f)

    0x7cd7b7fe5590 is located 336 bytes inside of 400-byte region [0x7cd7b7fe5440,0x7cd7b7fe55d0)
    freed by thread T0 here:
    SUMMARY: AddressSanitizer: 160 byte(s) leaked in 1 allocation(s).
---
 openair3/ocp-gtpu/gtp_itf.cpp | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/openair3/ocp-gtpu/gtp_itf.cpp b/openair3/ocp-gtpu/gtp_itf.cpp
index aca2fcbb32..cb73bfd06c 100644
--- a/openair3/ocp-gtpu/gtp_itf.cpp
+++ b/openair3/ocp-gtpu/gtp_itf.cpp
@@ -1283,7 +1283,7 @@ static int Gtpv1uHandleGpdu(int h, uint8_t *msgBuf, uint32_t msgBufLen, const st
   return !GTPNOK;
 }
 
-static void gtpv1uReceiveHandleMessage(int h)
+static bool gtpv1uReceiveHandleMessage(int h)
 {
   uint8_t udpData[65536];
   int udpDataLen;
@@ -1293,19 +1293,19 @@ static void gtpv1uReceiveHandleMessage(int h)
 
   if ((udpDataLen = recvfrom(h, udpData, sizeof(udpData), 0, (struct sockaddr *)&addr, &from_len)) < 0) {
     LOG_E(GTPU, "[%d] Recvfrom failed (%s)\n", h, strerror(errno));
-    return;
+    return false;
   } else if (udpDataLen == 0) {
     LOG_W(GTPU, "[%d] Recvfrom returned 0\n", h);
-    return;
+    return true;
   } else {
     if (udpDataLen < (int)sizeof(Gtpv1uMsgHeaderT)) {
       LOG_W(GTPU, "[%d] received malformed gtp packet \n", h);
-      return;
+      return true;
     }
     Gtpv1uMsgHeaderT *msg = (Gtpv1uMsgHeaderT *)udpData;
     if ((int)(ntohs(msg->msgLength) + sizeof(Gtpv1uMsgHeaderT)) != udpDataLen) {
       LOG_W(GTPU, "[%d] received malformed gtp packet length\n", h);
-      return;
+      return true;
     }
     LOG_D(GTPU, "[%d] Received GTP data, msg type: %x\n", h, msg->msgType);
     switch (msg->msgType) {
@@ -1337,13 +1337,13 @@ static void gtpv1uReceiveHandleMessage(int h)
         break;
     }
   }
+  return true;
 }
 
 static void* gtpv1uReceiver(void *thr)
 {
   gtpThread_t *gt = (gtpThread_t *)thr;
-  while (true) {
-    gtpv1uReceiveHandleMessage(gt->h);
+  while (gtpv1uReceiveHandleMessage(gt->h)) {
   }
   LOG_W(GTPU, "exiting thread\n");
   return NULL;