From b67c6396882e08fa0865f4902bdfa60aa58e9982 Mon Sep 17 00:00:00 2001 From: Robert Schmidt Date: Mon, 27 Oct 2025 16:47:24 +0100 Subject: [PATCH 01/10] Handle GTP receiver errors On error, exit the GTP thread after printing a diagnostic message. This avoids also an error flagged by address sanitizer for use-after-free. [GTPU] [91] Recvfrom failed (Bad file descriptor) ================================================================= ==285377==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cd7b7fe5590 at pc 0x0000006a9e18 bp 0x7b97ad4e1d50 sp 0x7b97ad4e1d48 READ of size 4 at 0x7cd7b7fe5590 thread T8 ================================================================= ==285377==ERROR: LeakSanitizer: detected memory leaks Direct leak of 160 byte(s) in 1 object(s) allocated from: #0 0x0000006a9e17 in gtpv1uReceiver /home/richie/oai/openair3/ocp-gtpu/gtp_itf.cpp:1346 #1 0x7f97b9a28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) #2 0x7f97b8e7ff53 in start_thread (/lib64/libc.so.6+0x71f53) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317) #3 0x7f97b8f0332b in __clone3 (/lib64/libc.so.6+0xf532b) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317) #0 0x7f97b9ae60cb in memalign (/lib64/libasan.so.8+0xe60cb) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) #1 0x000000471039 in newNotifiedFIFO_elt /home/richie/oai/common/utils/threadPool/notified_fifo.h:75 #2 0x000000471039 in tx_func /home/richie/oai/executables/nr-gnb.c:107 #3 0x000000471039 in L1_tx_thread /home/richie/oai/executables/nr-gnb.c:167 #4 0x7f97b9a28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) 0x7cd7b7fe5590 is located 336 bytes inside of 400-byte region [0x7cd7b7fe5440,0x7cd7b7fe55d0) freed by thread T0 here: SUMMARY: AddressSanitizer: 160 byte(s) leaked in 1 allocation(s). --- openair3/ocp-gtpu/gtp_itf.cpp | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/openair3/ocp-gtpu/gtp_itf.cpp b/openair3/ocp-gtpu/gtp_itf.cpp index aca2fcbb32..cb73bfd06c 100644 --- a/openair3/ocp-gtpu/gtp_itf.cpp +++ b/openair3/ocp-gtpu/gtp_itf.cpp @@ -1283,7 +1283,7 @@ static int Gtpv1uHandleGpdu(int h, uint8_t *msgBuf, uint32_t msgBufLen, const st return !GTPNOK; } -static void gtpv1uReceiveHandleMessage(int h) +static bool gtpv1uReceiveHandleMessage(int h) { uint8_t udpData[65536]; int udpDataLen; @@ -1293,19 +1293,19 @@ static void gtpv1uReceiveHandleMessage(int h) if ((udpDataLen = recvfrom(h, udpData, sizeof(udpData), 0, (struct sockaddr *)&addr, &from_len)) < 0) { LOG_E(GTPU, "[%d] Recvfrom failed (%s)\n", h, strerror(errno)); - return; + return false; } else if (udpDataLen == 0) { LOG_W(GTPU, "[%d] Recvfrom returned 0\n", h); - return; + return true; } else { if (udpDataLen < (int)sizeof(Gtpv1uMsgHeaderT)) { LOG_W(GTPU, "[%d] received malformed gtp packet \n", h); - return; + return true; } Gtpv1uMsgHeaderT *msg = (Gtpv1uMsgHeaderT *)udpData; if ((int)(ntohs(msg->msgLength) + sizeof(Gtpv1uMsgHeaderT)) != udpDataLen) { LOG_W(GTPU, "[%d] received malformed gtp packet length\n", h); - return; + return true; } LOG_D(GTPU, "[%d] Received GTP data, msg type: %x\n", h, msg->msgType); switch (msg->msgType) { @@ -1337,13 +1337,13 @@ static void gtpv1uReceiveHandleMessage(int h) break; } } + return true; } static void* gtpv1uReceiver(void *thr) { gtpThread_t *gt = (gtpThread_t *)thr; - while (true) { - gtpv1uReceiveHandleMessage(gt->h); + while (gtpv1uReceiveHandleMessage(gt->h)) { } LOG_W(GTPU, "exiting thread\n"); return NULL; From e40ccbb535ee1b6a81826ba9aabafab9da197021 Mon Sep 17 00:00:00 2001 From: Robert Schmidt Date: Mon, 27 Oct 2025 16:49:57 +0100 Subject: [PATCH 02/10] Stop GTP receiver thread on exit Stop the receive thread before closing the socket, which avoids an error message when stopping the GTP softmodem: [GTPU] [91] Recvfrom failed (Bad file descriptor) [GTPU] exiting thread --- openair3/ocp-gtpu/gtp_itf.cpp | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/openair3/ocp-gtpu/gtp_itf.cpp b/openair3/ocp-gtpu/gtp_itf.cpp index cb73bfd06c..c524129098 100644 --- a/openair3/ocp-gtpu/gtp_itf.cpp +++ b/openair3/ocp-gtpu/gtp_itf.cpp @@ -152,6 +152,7 @@ class gtpEndPoint { } }; +static void gtpv1uReceiverCancel(pthread_t t); class gtpEndPoints { public: pthread_mutex_t gtp_lock = PTHREAD_MUTEX_INITIALIZER; @@ -168,8 +169,10 @@ class gtpEndPoints { ~gtpEndPoints() { // automatically close all sockets on quit - for (const auto &p : instances) + for (const auto &p : instances) { + gtpv1uReceiverCancel(p.second.thrData.t); close(p.first); + } } }; @@ -1349,6 +1352,15 @@ static void* gtpv1uReceiver(void *thr) return NULL; } +static void gtpv1uReceiverCancel(pthread_t t) +{ + int rc; + rc = pthread_cancel(t); + DevAssert(rc == 0); + rc = pthread_join(t, NULL); + DevAssert(rc == 0); +} + #include void *gtpv1uTask(void *args) @@ -1370,6 +1382,8 @@ void *gtpv1uTask(void *args) // DATA TO BE SENT TO UDP case TERMINATE_MESSAGE: + LOG_W(GTPU, "Exiting GTP instance %ld\n", myInstance); + itti_exit_task(); break; case TIMER_HAS_EXPIRED: From 91b3ca77f650a289b262269fde68a0e1eb750bcc Mon Sep 17 00:00:00 2001 From: Robert Schmidt Date: Mon, 27 Oct 2025 17:16:43 +0100 Subject: [PATCH 03/10] QFI 0 is a valid QFI QFI 0 is a valid QFI: don't check for qfi <= 0, as uint8 cannot be negative. Also, correctly use SDAP_MAP_RULE_EMPTY for a DRB ID (which need to be larger than 0). --- openair2/SDAP/nr_sdap/nr_sdap_entity.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/openair2/SDAP/nr_sdap/nr_sdap_entity.c b/openair2/SDAP/nr_sdap/nr_sdap_entity.c index f0e791c683..9ff9e39471 100644 --- a/openair2/SDAP/nr_sdap/nr_sdap_entity.c +++ b/openair2/SDAP/nr_sdap/nr_sdap_entity.c @@ -210,8 +210,8 @@ static void nr_sdap_rx_entity(nr_sdap_entity_t *entity, { /* The offset of the SDAP header, it might be 0 if has_sdap_rx is not true in the pdcp entity. */ int offset=0; - int qfi = buf[0] & 0x3F; // QFI is always the first 6 bits in the first octet - if (qfi <= 0 || qfi >= SDAP_MAX_QFI) { + uint8_t qfi = buf[0] & 0x3F; // QFI is always the first 6 bits in the first octet + if (qfi >= SDAP_MAX_QFI) { LOG_E(SDAP, "Invalid QFI %d received in SDAP header\n", qfi); return; } @@ -450,7 +450,7 @@ static void nr_sdap_add_qos_flows_to_drb(nr_sdap_entity_t *entity, const sdap_co for (int i = 0; i < sdap->mappedQFIs2AddCount; i++) { uint8_t qfi = sdap->mappedQFIs2Add[i]; LOG_D(SDAP, "Adding QFI to DRB mapping rules: %d mapped QFIs for DRB %d\n", sdap->mappedQFIs2AddCount, sdap->drb_id); - if (qfi < SDAP_MAX_QFI && qfi > SDAP_MAP_RULE_EMPTY && sdap->drb_id > 0 && sdap->drb_id <= MAX_DRBS_PER_UE) { + if (qfi < SDAP_MAX_QFI && sdap->drb_id > SDAP_MAP_RULE_EMPTY && sdap->drb_id <= MAX_DRBS_PER_UE) { entity->qfi2drb_map_add(entity, qfi, sdap->drb_id, sdap->role); } else { LOG_E(SDAP, "Failed to add qfi2drb mapping: QFI=%d, DRB=%d\n", qfi, sdap->drb_id); From a416db39ba44806ce1750fb75493897df5d9a400 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Mon, 27 Oct 2025 18:05:22 +0100 Subject: [PATCH 04/10] Pass SDAP config by pointer sdap_config_t is more than 1kB large. Avoid excessive copying by passing it by reference. --- openair2/LAYER2/nr_pdcp/cucp_cuup_handler.c | 2 +- openair2/RRC/NR/rrc_gNB_nsa.c | 2 +- openair2/RRC/NR_UE/rrc_UE.c | 2 +- openair2/SDAP/nr_sdap/nr_sdap_entity.c | 16 ++++++++-------- openair2/SDAP/nr_sdap/nr_sdap_entity.h | 2 +- 5 files changed, 12 insertions(+), 12 deletions(-) diff --git a/openair2/LAYER2/nr_pdcp/cucp_cuup_handler.c b/openair2/LAYER2/nr_pdcp/cucp_cuup_handler.c index ed9cc37c18..4b95963257 100644 --- a/openair2/LAYER2/nr_pdcp/cucp_cuup_handler.c +++ b/openair2/LAYER2/nr_pdcp/cucp_cuup_handler.c @@ -153,7 +153,7 @@ static void e1_add_bearers(const int ue_id, const NR_DRB_ToAddModList_t *addMod, // get SDAP config sdap_config_t sdap = nr_sdap_get_config(GNB_FLAG_YES, drb->cnAssociation->choice.sdap_Config, drb->drb_Identity); // add SDAP entity - nr_sdap_addmod_entity(GNB_FLAG_YES, ue_id, sdap); + nr_sdap_addmod_entity(GNB_FLAG_YES, ue_id, &sdap); // add PDCP entity nr_pdcp_add_drb(GNB_FLAG_YES, ue_id, drb->pdcp_Config, &sdap, sp); } diff --git a/openair2/RRC/NR/rrc_gNB_nsa.c b/openair2/RRC/NR/rrc_gNB_nsa.c index 996dc3528e..3e3c462145 100644 --- a/openair2/RRC/NR/rrc_gNB_nsa.c +++ b/openair2/RRC/NR/rrc_gNB_nsa.c @@ -177,7 +177,7 @@ static void rrc_nsa_add_drb(const int ue_id, sdap.drb_id = drb->drb_Identity; sdap.defaultDRB = true; // add SDAP entity (terminated at gNB, since it's EPC) - nr_sdap_addmod_entity(GNB_FLAG_YES, ue_id, sdap); + nr_sdap_addmod_entity(GNB_FLAG_YES, ue_id, &sdap); // add PDCP entity nr_pdcp_add_drb(GNB_FLAG_YES, ue_id, drb->pdcp_Config, &sdap, sp); } diff --git a/openair2/RRC/NR_UE/rrc_UE.c b/openair2/RRC/NR_UE/rrc_UE.c index 6681eed855..15c713cb26 100644 --- a/openair2/RRC/NR_UE/rrc_UE.c +++ b/openair2/RRC/NR_UE/rrc_UE.c @@ -619,7 +619,7 @@ static void rrc_ue_add_bearer(const int ue_id, const NR_DRB_ToAddMod_t *drb, con sdap = nr_sdap_get_config(GNB_FLAG_NO, drb->cnAssociation->choice.sdap_Config, drb->drb_Identity); } // add SDAP entity - nr_sdap_addmod_entity(GNB_FLAG_NO, ue_id, sdap); + nr_sdap_addmod_entity(GNB_FLAG_NO, ue_id, &sdap); // add PDCP entity nr_pdcp_add_drb(GNB_FLAG_NO, ue_id, drb->pdcp_Config, &sdap, sp); } diff --git a/openair2/SDAP/nr_sdap/nr_sdap_entity.c b/openair2/SDAP/nr_sdap/nr_sdap_entity.c index 9ff9e39471..389213986e 100644 --- a/openair2/SDAP/nr_sdap/nr_sdap_entity.c +++ b/openair2/SDAP/nr_sdap/nr_sdap_entity.c @@ -487,13 +487,13 @@ static void nr_sdap_qfi2drb_map_update(nr_sdap_entity_t *entity, const sdap_conf * @param is_gnb, indicates whether it is for gNB or UE * @param ue_id, UE ID * @param sdap, SDAP configuration */ -static void nr_sdap_add_entity(const int is_gnb, const ue_id_t ue_id, const sdap_config_t sdap) +static void nr_sdap_add_entity(const int is_gnb, const ue_id_t ue_id, const sdap_config_t *sdap) { nr_sdap_entity_t *sdap_entity = calloc_or_fail(1, sizeof(*sdap_entity)); // SDAP entity ids sdap_entity->ue_id = ue_id; - sdap_entity->pdusession_id = sdap.pdusession_id; + sdap_entity->pdusession_id = sdap->pdusession_id; sdap_entity->is_gnb = is_gnb; // rx/tx entities @@ -513,13 +513,13 @@ static void nr_sdap_add_entity(const int is_gnb, const ue_id_t ue_id, const sdap sdap_entity->pdusession_sock = -1; // set default DRB - if (sdap.defaultDRB) { - sdap_entity->default_drb = sdap.drb_id; + if (sdap->defaultDRB) { + sdap_entity->default_drb = sdap->drb_id; LOG_I(SDAP, "Default DRB for the created SDAP entity: DRB %d \n", sdap_entity->default_drb); } // Add QoS flows to the DRB (initial configuration) - nr_sdap_add_qos_flows_to_drb(sdap_entity, &sdap); + nr_sdap_add_qos_flows_to_drb(sdap_entity, sdap); // update SDAP entity list pointers sdap_entity->next_entity = sdap_info.sdap_entity_llist; @@ -533,11 +533,11 @@ static void nr_sdap_add_entity(const int is_gnb, const ue_id_t ue_id, const sdap } /** @brief Add or modify an SDAP entity if it already exists */ -void nr_sdap_addmod_entity(const int is_gnb, const ue_id_t ue_id, const sdap_config_t sdap) +void nr_sdap_addmod_entity(const int is_gnb, const ue_id_t ue_id, const sdap_config_t *sdap) { - nr_sdap_entity_t *sdap_entity = nr_sdap_get_entity(ue_id, sdap.pdusession_id); + nr_sdap_entity_t *sdap_entity = nr_sdap_get_entity(ue_id, sdap->pdusession_id); if (sdap_entity) { - sdap_entity->qfi2drb_map_update(sdap_entity, &sdap); + sdap_entity->qfi2drb_map_update(sdap_entity, sdap); } else { nr_sdap_add_entity(is_gnb, ue_id, sdap); } diff --git a/openair2/SDAP/nr_sdap/nr_sdap_entity.h b/openair2/SDAP/nr_sdap/nr_sdap_entity.h index a206189035..e96836ac79 100644 --- a/openair2/SDAP/nr_sdap/nr_sdap_entity.h +++ b/openair2/SDAP/nr_sdap/nr_sdap_entity.h @@ -172,7 +172,7 @@ sdap_config_t nr_sdap_get_config(const int is_gnb, const NR_SDAP_Config_t *sdap_ void nr_sdap_release_drb(ue_id_t ue_id, int drb_id, int pdusession_id); /** @brief Add or modify an SDAP entity based on whether it already exists */ -void nr_sdap_addmod_entity(const int is_gnb, const ue_id_t ue_id, const sdap_config_t sdap); +void nr_sdap_addmod_entity(const int is_gnb, const ue_id_t ue_id, const sdap_config_t *sdap); /** * @brief Function to delete a single SDAP Entity based on the ue_id and pdusession_id. From 459e20fe99e6b4666e8e2f679ca6ccf2d74a2027 Mon Sep 17 00:00:00 2001 From: Robert Schmidt Date: Mon, 27 Oct 2025 18:47:19 +0100 Subject: [PATCH 05/10] E1AP: correctly free entire PDU Free memory including the "base pointer". Fix two places in which it was on the stack to harmonize. The only stack variable is in reception of new E1 messages (e1ap_handle_message()), which uses ASN_STRUCT_FREE_CONTENTS_ONLY(). This fixes bugs similar to these logs: Direct leak of 40 byte(s) in 1 object(s) allocated from: #0 0x7f418f4e68a3 in calloc (/lib64/libasan.so.8+0xe68a3) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) #1 0x00000049e367 in calloc_or_fail /home/richie/oai/common/utils/utils.h:74 #2 0x00000049e367 in encode_e1_bearer_context_release_command /home/richie/oai/openair2/E1AP/lib/e1ap_bearer_context_management.c:1235 #3 0x000000482951 in e1apCUCP_send_BEARER_CONTEXT_RELEASE_COMMAND /home/richie/oai/openair2/E1AP/e1ap.c:546 #4 0x000000482951 in E1AP_CUCP_task /home/richie/oai/openair2/E1AP/e1ap.c:856 #5 0x7f418f428ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) Direct leak of 40 byte(s) in 1 object(s) allocated from: #0 0x7f418f4e68a3 in calloc (/lib64/libasan.so.8+0xe68a3) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) #1 0x00000049380a in calloc_or_fail /home/richie/oai/common/utils/utils.h:74 #2 0x00000049380a in encode_E1_bearer_context_setup_request /home/richie/oai/openair2/E1AP/lib/e1ap_bearer_context_management.c:578 #3 0x00000047f6a2 in e1apCUCP_send_BEARER_CONTEXT_SETUP_REQUEST /home/richie/oai/openair2/E1AP/e1ap.c:378 #4 0x0000004829f8 in E1AP_CUCP_task /home/richie/oai/openair2/E1AP/e1ap.c:846 #5 0x7f418f428ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) Direct leak of 40 byte(s) in 1 object(s) allocated from: #0 0x7f418f4e68a3 in calloc (/lib64/libasan.so.8+0xe68a3) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) #1 0x00000046ede7 in calloc_or_fail /home/richie/oai/common/utils/utils.h:74 #2 0x00000046ede7 in encode_e1ap_cuup_setup_response /home/richie/oai/openair2/E1AP/lib/e1ap_interface_management.c:305 #3 0x00000047e412 in e1ap_send_SETUP_RESPONSE /home/richie/oai/openair2/E1AP/e1ap.c:167 #4 0x000000482a68 in E1AP_CUCP_task /home/richie/oai/openair2/E1AP/e1ap.c:836 #5 0x7f418f428ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) --- openair2/E1AP/e1ap.c | 10 +++++----- openair2/E1AP/e1ap_common.c | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/openair2/E1AP/e1ap.c b/openair2/E1AP/e1ap.c index 1eff4ea529..168366f351 100644 --- a/openair2/E1AP/e1ap.c +++ b/openair2/E1AP/e1ap.c @@ -125,8 +125,8 @@ static void e1_task_handle_sctp_data_ind(instance_t instance, sctp_data_ind_t *s int e1ap_send_RESET(bool isCu, sctp_assoc_t assoc_id, E1AP_Reset_t *Reset) { AssertFatal(false, "Not implemented yet\n"); - E1AP_E1AP_PDU_t pdu = {0}; - return e1ap_encode_send(isCu, assoc_id, &pdu, 0, __func__); + E1AP_E1AP_PDU_t *pdu = calloc_or_fail(1, sizeof(*pdu)); + return e1ap_encode_send(isCu, assoc_id, pdu, 0, __func__); } int e1ap_send_RESET_ACKNOWLEDGE(instance_t instance, E1AP_Reset_t *Reset) @@ -304,9 +304,9 @@ static void fill_CONFIGURATION_UPDATE(E1AP_E1AP_PDU_t *pdu) void e1apCUUP_send_CONFIGURATION_UPDATE(sctp_assoc_t assoc_id) { - E1AP_E1AP_PDU_t pdu = {0}; - fill_CONFIGURATION_UPDATE(&pdu); - e1ap_encode_send(UPtype, assoc_id, &pdu, 0, __func__); + E1AP_E1AP_PDU_t *pdu = calloc_or_fail(1, sizeof(*pdu)); + fill_CONFIGURATION_UPDATE(pdu); + e1ap_encode_send(UPtype, assoc_id, pdu, 0, __func__); } int e1apCUCP_send_gNB_DU_CONFIGURATION_FAILURE(void) diff --git a/openair2/E1AP/e1ap_common.c b/openair2/E1AP/e1ap_common.c index 330d29567a..e102c7e151 100644 --- a/openair2/E1AP/e1ap_common.c +++ b/openair2/E1AP/e1ap_common.c @@ -226,7 +226,7 @@ int e1ap_encode_send(E1_t type, sctp_assoc_t assoc_id, E1AP_E1AP_PDU_t *pdu, uin void *buffer = NULL; ssize_t encoded = aper_encode_to_new_buffer(&asn_DEF_E1AP_E1AP_PDU, 0, pdu, &buffer); - ASN_STRUCT_FREE_CONTENTS_ONLY(asn_DEF_E1AP_E1AP_PDU, pdu); + ASN_STRUCT_FREE(asn_DEF_E1AP_E1AP_PDU, pdu); if (encoded < 0) { LOG_E(E1AP, "%s: Failed to encode E1AP message\n", func); From eee9c4cf33dbc9475947762539f06e8ad8440fe6 Mon Sep 17 00:00:00 2001 From: Robert Schmidt Date: Mon, 27 Oct 2025 18:50:45 +0100 Subject: [PATCH 06/10] Fix two direct memory leaks of CU-UP tester Direct leak of 100 byte(s) in 1 object(s) allocated from: #0 0x7f6585ee6f2b in malloc (/lib64/libasan.so.8+0xe6f2b) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) #1 0x000000414a0d in malloc_or_fail /home/richie/oai/common/utils/utils.h:86 #2 0x0000004061c9 in main /home/richie/oai/tests/nr-cuup/nr-cuup-load-test.c:544 #3 0x7f6585211574 in __libc_start_call_main (/lib64/libc.so.6+0x3574) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317) #4 0x7f6585211627 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x3627) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317) #5 0x000000413034 in _start (/home/richie/oai/build/tests/nr-cuup/nr-cuup-load-test+0x413034) (BuildId: 8af0132792b03fa12ba95b5623865c9a8a5625a3) Direct leak of 100 byte(s) in 1 object(s) allocated from: #0 0x7f6585ee6f2b in malloc (/lib64/libasan.so.8+0xe6f2b) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) #1 0x000000414a0d in malloc_or_fail /home/richie/oai/common/utils/utils.h:86 #2 0x0000004061ff in main /home/richie/oai/tests/nr-cuup/nr-cuup-load-test.c:546 #3 0x7f6585211574 in __libc_start_call_main (/lib64/libc.so.6+0x3574) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317) #4 0x7f6585211627 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x3627) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317) #5 0x000000413034 in _start (/home/richie/oai/build/tests/nr-cuup/nr-cuup-load-test+0x413034) (BuildId: 8af0132792b03fa12ba95b5623865c9a8a5625a3) --- tests/nr-cuup/nr-cuup-load-test.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/nr-cuup/nr-cuup-load-test.c b/tests/nr-cuup/nr-cuup-load-test.c index 533b119c9e..8cc5256744 100644 --- a/tests/nr-cuup/nr-cuup-load-test.c +++ b/tests/nr-cuup/nr-cuup-load-test.c @@ -664,6 +664,9 @@ int main(int argc, char *argv[]) success = false; } + free(ng_ip); + free(f1_ip); + if (success) LOG_A(GNB_APP, "test succeeded\n"); else From 155ee5ad42ee054164a07b3f9f46c78ad86c14cc Mon Sep 17 00:00:00 2001 From: Robert Schmidt Date: Mon, 27 Oct 2025 18:51:49 +0100 Subject: [PATCH 07/10] Fix direct memory leak on E1 message reception Direct leak of 8 byte(s) in 1 object(s) allocated from: #0 0x7f7bc7ee68a3 in calloc (/lib64/libasan.so.8+0xe68a3) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) #1 0x0000004abfa6 in calloc_or_fail /home/richie/oai/common/utils/utils.h:74 #2 0x0000004abfa6 in decode_e1ap_cuup_setup_request /home/richie/oai/openair2/E1AP/lib/e1ap_interface_management.c:219 #3 0x00000046a9f5 in e1apCUCP_handle_SETUP_REQUEST /home/richie/oai/openair2/E1AP/e1ap.c:187 #4 0x000000470b35 in e1ap_handle_message /home/richie/oai/openair2/E1AP/e1ap.c:109 #5 0x000000470b35 in e1_task_handle_sctp_data_ind /home/richie/oai/openair2/E1AP/e1ap.c:120 #6 0x00000047717b in E1AP_CUCP_task /home/richie/oai/openair2/E1AP/e1ap.c:832 #7 0x7f7bc7e28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) Direct leak of 8 byte(s) in 1 object(s) allocated from: #0 0x7f7bc7ee68a3 in calloc (/lib64/libasan.so.8+0xe68a3) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) #1 0x0000004ac30c in calloc_or_fail /home/richie/oai/common/utils/utils.h:74 #2 0x0000004ac30c in decode_e1ap_cuup_setup_request /home/richie/oai/openair2/E1AP/lib/e1ap_interface_management.c:194 #3 0x00000046a9f5 in e1apCUCP_handle_SETUP_REQUEST /home/richie/oai/openair2/E1AP/e1ap.c:187 #4 0x000000470b35 in e1ap_handle_message /home/richie/oai/openair2/E1AP/e1ap.c:109 #5 0x000000470b35 in e1_task_handle_sctp_data_ind /home/richie/oai/openair2/E1AP/e1ap.c:120 #6 0x00000047717b in E1AP_CUCP_task /home/richie/oai/openair2/E1AP/e1ap.c:832 #7 0x7f7bc7e28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 10b8ccd49f75c21babf1d7abe51bb63589d8471f) --- tests/nr-cuup/nr-cuup-load-test.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/nr-cuup/nr-cuup-load-test.c b/tests/nr-cuup/nr-cuup-load-test.c index 8cc5256744..0774b26b1b 100644 --- a/tests/nr-cuup/nr-cuup-load-test.c +++ b/tests/nr-cuup/nr-cuup-load-test.c @@ -28,6 +28,7 @@ #include "openair3/SCTP/sctp_eNB_task.h" #include "openair2/E1AP/e1ap.h" #include "openair3/ocp-gtpu/gtp_itf.h" +#include "openair2/E1AP/lib/e1ap_interface_management.h" configmodule_interface_t *uniqCfg; @@ -90,6 +91,7 @@ static void setup_cuup(sctp_assoc_t *assoc_id, e1ap_nssai_t *nssai) DevAssert(req->plmn[0].slice != NULL); *nssai = *req->plmn[0].slice; DevAssert(assoc_id != 0); + free_e1ap_cuup_setup_request(req); itti_free(TASK_GNB_APP, itti_req); // acknowledge the E1 setup request with a response From a2b127f643ba5095fbc1c3b19f249746706542b1 Mon Sep 17 00:00:00 2001 From: Robert Schmidt Date: Mon, 27 Oct 2025 18:54:19 +0100 Subject: [PATCH 08/10] CU-UP: fix direct memory leak Note that this strdup has been intentioally created for debugging purposes in core files. See also: 1ab3b8dd8e0a ("add version signature in core files...") --- executables/nr-cuup.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/executables/nr-cuup.c b/executables/nr-cuup.c index 403f78ddb3..0c2c9cdf3f 100644 --- a/executables/nr-cuup.c +++ b/executables/nr-cuup.c @@ -150,7 +150,8 @@ int main(int argc, char **argv) time_manager_start(tick_functions, tick_functions_count, TIME_SOURCE_REALTIME); // strdup to put the sring in the core file for post mortem identification - LOG_I(HW, "Version: %s\n", strdup(OAI_PACKAGE_VERSION)); + char *v = strdup(OAI_PACKAGE_VERSION); + LOG_I(HW, "Version: %s\n", v); set_softmodem_sighandler(); itti_init(TASK_MAX, tasks_info); int rc; @@ -189,6 +190,8 @@ int main(int argc, char **argv) time_manager_finish(); + free(v); + logClean(); printf("Bye.\n"); return 0; From e9bf6344b01372a1fcd36cbb62381d92b0b276cf Mon Sep 17 00:00:00 2001 From: Robert Schmidt Date: Mon, 27 Oct 2025 18:56:42 +0100 Subject: [PATCH 09/10] SCTP: fix a memory leak call freeaddrinfo() before return'ing from the function. --- openair3/SCTP/sctp_eNB_task.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair3/SCTP/sctp_eNB_task.c b/openair3/SCTP/sctp_eNB_task.c index 82afa451c0..567a166491 100644 --- a/openair3/SCTP/sctp_eNB_task.c +++ b/openair3/SCTP/sctp_eNB_task.c @@ -477,6 +477,7 @@ static void sctp_handle_new_association_req(const instance_t instance, if (errno != EINPROGRESS) { SCTP_ERROR("Connect failed: %s\n", strerror(errno)); sctp_itti_send_association_resp(requestor, instance, -1, req->ulp_cnx_id, SCTP_STATE_UNREACHABLE, 0, 0); + freeaddrinfo(serv); close(sd); return; } else { From eced5afdf72f95948fdf81452528bfcd469cc23d Mon Sep 17 00:00:00 2001 From: Robert Schmidt Date: Tue, 28 Oct 2025 08:25:06 +0100 Subject: [PATCH 10/10] Add CU-UP functional test to ctest Use the CU-UP load tester to test the functionality of the CU-UP and its loader tester. The requirements on this load test are intentionally low, as it will be run with other unit tests in parallel, and should still pass. It uses an existing configuration file for the CU-UP. The test script runs the CU-UP, runs the load tester, stops the CU-UP, and returns the load tester return value as test result (which will be 0=success if all packets have been received). --- tests/nr-cuup/CMakeLists.txt | 10 ++++++++++ tests/nr-cuup/nr-cuup-functional-test.sh | 21 +++++++++++++++++++++ 2 files changed, 31 insertions(+) create mode 100755 tests/nr-cuup/nr-cuup-functional-test.sh diff --git a/tests/nr-cuup/CMakeLists.txt b/tests/nr-cuup/CMakeLists.txt index 02becb2496..9d48fd89e2 100644 --- a/tests/nr-cuup/CMakeLists.txt +++ b/tests/nr-cuup/CMakeLists.txt @@ -1,4 +1,14 @@ add_executable(nr-cuup-load-test nr-cuup-load-test.c) +add_dependencies(nr-cuup-load-test params_libconfig) target_link_libraries(nr-cuup-load-test PRIVATE GTPV1U ${T_LIB} utils ITTI e1ap SCTP_CLIENT) target_link_libraries(nr-cuup-load-test PRIVATE asn1_lte_rrc_hdrs asn1_nr_rrc_hdrs) # ITTI + +if(ENABLE_TESTS) + # we add also nr-cuup as it is required for the test + add_dependencies(tests nr-cuup-load-test nr-cuup) + add_test(NAME nr_cuup_functional_test + COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/nr-cuup-functional-test.sh ${CMAKE_CURRENT_SOURCE_DIR}/load-test.conf + WORKING_DIRECTORY ${CMAKE_BINARY_DIR} + ) +endif() diff --git a/tests/nr-cuup/nr-cuup-functional-test.sh b/tests/nr-cuup/nr-cuup-functional-test.sh new file mode 100755 index 0000000000..28a9b3779a --- /dev/null +++ b/tests/nr-cuup/nr-cuup-functional-test.sh @@ -0,0 +1,21 @@ +#!/bin/bash + +# this script takes one argument, which is the path to the CU-UP configuration +if [ $# -ne 1 ]; then + echo "usage: $0 " + exit 1 +fi + +CONFIG=$1 + +set -x + +# current dir should be CMAKE_BINARY_DIR +./nr-cuup -O ${CONFIG} & +CUUP_PID=$! + +timeout 5s ./tests/nr-cuup/nr-cuup-load-test -t 3 -d 10 -u 10 +RET=$? + +kill ${CUUP_PID} +exit ${RET}