fix (NR UE): allocate/free rxdata pointer for neighbor measurements

Fix a UE crash in the neighbor-measurement task setup by allocating the per-antenna
rxdata pointer array before indexing it in pbch_processing(), and freeing it in
nr_ue_meas_neighboring_cell() after measurements complete.

The crash is triggered by intra-frequency neighbor measurements.
This commit is contained in:
Guido Casati
2026-04-16 15:01:13 +02:00
parent 5fcd456a46
commit f6b6ce2da3
2 changed files with 3 additions and 1 deletions
@@ -459,6 +459,7 @@ void nr_ue_meas_neighboring_cell(void *arg)
do_neighboring_cell_measurements(&args->proc, args->ue, args->rxdata, args->rxdata_size);
args->ue->measurements.meas_request_pending = false;
free(args->rxdata);
free(args);
}
+2 -1
View File
@@ -1201,10 +1201,11 @@ int pbch_processing(PHY_VARS_NR_UE *ue, const UE_nr_rxtx_proc_t *proc, nr_phy_da
// Copy rxdata
uint32_t rxdata_size = (2 * (fp->samples_per_frame) + fp->ofdm_symbol_size);
size_t total_size = sizeof(nr_meas_task_args_t) + fp->nb_antennas_rx * rxdata_size * sizeof(c16_t);
nr_meas_task_args_t *args = malloc(total_size);
nr_meas_task_args_t *args = malloc_or_fail(total_size);
args->proc = *proc;
args->ue = ue;
args->rxdata_size = rxdata_size;
args->rxdata = malloc_or_fail(fp->nb_antennas_rx * sizeof(*args->rxdata));
for (int i = 0; i < fp->nb_antennas_rx; i++) {
args->rxdata[i] = &args->rxdata_ant[i * rxdata_size];