Handle GTP receiver errors
On error, exit the GTP thread after printing a diagnostic message. This
avoids also an error flagged by address sanitizer for use-after-free.
[GTPU] [91] Recvfrom failed (Bad file descriptor)
=================================================================
==285377==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cd7b7fe5590 at pc 0x0000006a9e18 bp 0x7b97ad4e1d50 sp 0x7b97ad4e1d48
READ of size 4 at 0x7cd7b7fe5590 thread T8
=================================================================
==285377==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 160 byte(s) in 1 object(s) allocated from:
#0 0x0000006a9e17 in gtpv1uReceiver /home/richie/oai/openair3/ocp-gtpu/gtp_itf.cpp:1346
#1 0x7f97b9a28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f)
#2 0x7f97b8e7ff53 in start_thread (/lib64/libc.so.6+0x71f53) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317)
#3 0x7f97b8f0332b in __clone3 (/lib64/libc.so.6+0xf532b) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317)
#0 0x7f97b9ae60cb in memalign (/lib64/libasan.so.8+0xe60cb) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f)
#1 0x000000471039 in newNotifiedFIFO_elt /home/richie/oai/common/utils/threadPool/notified_fifo.h:75
#2 0x000000471039 in tx_func /home/richie/oai/executables/nr-gnb.c:107
#3 0x000000471039 in L1_tx_thread /home/richie/oai/executables/nr-gnb.c:167
#4 0x7f97b9a28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f)
0x7cd7b7fe5590 is located 336 bytes inside of 400-byte region [0x7cd7b7fe5440,0x7cd7b7fe55d0)
freed by thread T0 here:
SUMMARY: AddressSanitizer: 160 byte(s) leaked in 1 allocation(s).
This commit is contained in:
@@ -1283,7 +1283,7 @@ static int Gtpv1uHandleGpdu(int h, uint8_t *msgBuf, uint32_t msgBufLen, const st
|
|||||||
return !GTPNOK;
|
return !GTPNOK;
|
||||||
}
|
}
|
||||||
|
|
||||||
static void gtpv1uReceiveHandleMessage(int h)
|
static bool gtpv1uReceiveHandleMessage(int h)
|
||||||
{
|
{
|
||||||
uint8_t udpData[65536];
|
uint8_t udpData[65536];
|
||||||
int udpDataLen;
|
int udpDataLen;
|
||||||
@@ -1293,19 +1293,19 @@ static void gtpv1uReceiveHandleMessage(int h)
|
|||||||
|
|
||||||
if ((udpDataLen = recvfrom(h, udpData, sizeof(udpData), 0, (struct sockaddr *)&addr, &from_len)) < 0) {
|
if ((udpDataLen = recvfrom(h, udpData, sizeof(udpData), 0, (struct sockaddr *)&addr, &from_len)) < 0) {
|
||||||
LOG_E(GTPU, "[%d] Recvfrom failed (%s)\n", h, strerror(errno));
|
LOG_E(GTPU, "[%d] Recvfrom failed (%s)\n", h, strerror(errno));
|
||||||
return;
|
return false;
|
||||||
} else if (udpDataLen == 0) {
|
} else if (udpDataLen == 0) {
|
||||||
LOG_W(GTPU, "[%d] Recvfrom returned 0\n", h);
|
LOG_W(GTPU, "[%d] Recvfrom returned 0\n", h);
|
||||||
return;
|
return true;
|
||||||
} else {
|
} else {
|
||||||
if (udpDataLen < (int)sizeof(Gtpv1uMsgHeaderT)) {
|
if (udpDataLen < (int)sizeof(Gtpv1uMsgHeaderT)) {
|
||||||
LOG_W(GTPU, "[%d] received malformed gtp packet \n", h);
|
LOG_W(GTPU, "[%d] received malformed gtp packet \n", h);
|
||||||
return;
|
return true;
|
||||||
}
|
}
|
||||||
Gtpv1uMsgHeaderT *msg = (Gtpv1uMsgHeaderT *)udpData;
|
Gtpv1uMsgHeaderT *msg = (Gtpv1uMsgHeaderT *)udpData;
|
||||||
if ((int)(ntohs(msg->msgLength) + sizeof(Gtpv1uMsgHeaderT)) != udpDataLen) {
|
if ((int)(ntohs(msg->msgLength) + sizeof(Gtpv1uMsgHeaderT)) != udpDataLen) {
|
||||||
LOG_W(GTPU, "[%d] received malformed gtp packet length\n", h);
|
LOG_W(GTPU, "[%d] received malformed gtp packet length\n", h);
|
||||||
return;
|
return true;
|
||||||
}
|
}
|
||||||
LOG_D(GTPU, "[%d] Received GTP data, msg type: %x\n", h, msg->msgType);
|
LOG_D(GTPU, "[%d] Received GTP data, msg type: %x\n", h, msg->msgType);
|
||||||
switch (msg->msgType) {
|
switch (msg->msgType) {
|
||||||
@@ -1337,13 +1337,13 @@ static void gtpv1uReceiveHandleMessage(int h)
|
|||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
static void* gtpv1uReceiver(void *thr)
|
static void* gtpv1uReceiver(void *thr)
|
||||||
{
|
{
|
||||||
gtpThread_t *gt = (gtpThread_t *)thr;
|
gtpThread_t *gt = (gtpThread_t *)thr;
|
||||||
while (true) {
|
while (gtpv1uReceiveHandleMessage(gt->h)) {
|
||||||
gtpv1uReceiveHandleMessage(gt->h);
|
|
||||||
}
|
}
|
||||||
LOG_W(GTPU, "exiting thread\n");
|
LOG_W(GTPU, "exiting thread\n");
|
||||||
return NULL;
|
return NULL;
|
||||||
|
|||||||
Reference in New Issue
Block a user