From f6b6ce2da392add578e771b4268531c5e95cece7 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Thu, 16 Apr 2026 15:01:13 +0200 Subject: [PATCH 1/2] fix (NR UE): allocate/free rxdata pointer for neighbor measurements Fix a UE crash in the neighbor-measurement task setup by allocating the per-antenna rxdata pointer array before indexing it in pbch_processing(), and freeing it in nr_ue_meas_neighboring_cell() after measurements complete. The crash is triggered by intra-frequency neighbor measurements. --- openair1/PHY/NR_UE_ESTIMATION/nr_ue_measurements.c | 1 + openair1/SCHED_NR_UE/phy_procedures_nr_ue.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/openair1/PHY/NR_UE_ESTIMATION/nr_ue_measurements.c b/openair1/PHY/NR_UE_ESTIMATION/nr_ue_measurements.c index 685f1902cd..65d0f11593 100644 --- a/openair1/PHY/NR_UE_ESTIMATION/nr_ue_measurements.c +++ b/openair1/PHY/NR_UE_ESTIMATION/nr_ue_measurements.c @@ -459,6 +459,7 @@ void nr_ue_meas_neighboring_cell(void *arg) do_neighboring_cell_measurements(&args->proc, args->ue, args->rxdata, args->rxdata_size); args->ue->measurements.meas_request_pending = false; + free(args->rxdata); free(args); } diff --git a/openair1/SCHED_NR_UE/phy_procedures_nr_ue.c b/openair1/SCHED_NR_UE/phy_procedures_nr_ue.c index 225634937b..18e5dbe269 100644 --- a/openair1/SCHED_NR_UE/phy_procedures_nr_ue.c +++ b/openair1/SCHED_NR_UE/phy_procedures_nr_ue.c @@ -1201,10 +1201,11 @@ int pbch_processing(PHY_VARS_NR_UE *ue, const UE_nr_rxtx_proc_t *proc, nr_phy_da // Copy rxdata uint32_t rxdata_size = (2 * (fp->samples_per_frame) + fp->ofdm_symbol_size); size_t total_size = sizeof(nr_meas_task_args_t) + fp->nb_antennas_rx * rxdata_size * sizeof(c16_t); - nr_meas_task_args_t *args = malloc(total_size); + nr_meas_task_args_t *args = malloc_or_fail(total_size); args->proc = *proc; args->ue = ue; args->rxdata_size = rxdata_size; + args->rxdata = malloc_or_fail(fp->nb_antennas_rx * sizeof(*args->rxdata)); for (int i = 0; i < fp->nb_antennas_rx; i++) { args->rxdata[i] = &args->rxdata_ant[i * rxdata_size]; From 32cb3401b4feb008dccb984cc4e33a723219a36d Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Thu, 16 Apr 2026 15:03:46 +0200 Subject: [PATCH 2/2] fix (gNB config): cell ID and PCI from outgoing F1 Setup Request --- openair2/GNB_APP/gnb_config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair2/GNB_APP/gnb_config.c b/openair2/GNB_APP/gnb_config.c index a73a77b0ee..f8991fc587 100644 --- a/openair2/GNB_APP/gnb_config.c +++ b/openair2/GNB_APP/gnb_config.c @@ -1822,7 +1822,7 @@ void RCconfig_nr_macrlc(configmodule_interface_t *cfg) seq_arr_t *du_SIBs = RC.nrmac[0]->common_channels[0].du_SIBs; f1ap_setup_req_t *req = RC_read_F1Setup(gnb_du_id, name, &info, scc, mib, sib1, du_SIBs); AssertFatal(req != NULL, "could not read F1 Setup information\n"); - LOG_I(GNB_APP, "Configured DU: cell ID %lu, PCI %d\n", info.nr_cellid, info.nr_pci); + LOG_I(GNB_APP, "Configured DU: cell ID %ld, PCI %d\n", req->cell[0].info.nr_cellid, req->cell[0].info.nr_pci); RC.nrmac[0]->f1_config.setup_req = req; RC.nrmac[0]->f1_config.gnb_id = gnb_id;