From feea066c3f1922e41c23859544d287fb7a11cf5e Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Tue, 23 Sep 2025 16:15:15 +0200 Subject: [PATCH] Fix measurement gap config memory leak in create_measgap_config - Add missing ASN_STRUCT_FREE for NR_MeasGapConfig in create_measgap_config - Fix 48-byte measurement gap config leak in get_gap_config_from_smtc AddressSanitizer backtrace: Direct leak of 48 byte(s) in 1 object(s) allocated from: /#0 0x7d32adab4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 /#1 0x5751f99cbb79 in calloc_or_fail /home/guido/repo/openairinterface5g/develop/common/utils/utils.h:74 /#2 0x5751f99cbb79 in get_gap_config_from_smtc /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c:4164 /#3 0x5751f99cbb79 in create_measgap_config /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c:4310 /#4 0x5751f9964abe in ue_context_setup_request /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:709 /#5 0x5751f979e568 in nr_initiate_handover /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:218 /#6 0x5751f97a637f in nr_rrc_trigger_n2_ho_target /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:526 /#7 0x5751f9703608 in rrc_gNB_process_e1_bearer_context_setup_resp /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:2641 /#8 0x5751f9706b7b in rrc_gnb_task /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:3020 /#9 0x7d32ac494ac2 in start_thread nptl/pthread_create.c:442 Root cause: create_measgap_config allocated NR_MeasGapConfig via get_gap_config_from_smtc() but never freed it after extracting the needed values to populate the measgap_config_t return structure. --- openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c b/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c index 44cb211b1d..8d6731dbbd 100644 --- a/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c +++ b/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c @@ -4361,8 +4361,10 @@ measgap_config_t create_measgap_config(const NR_MeasurementTimingConfiguration_t const NR_SSB_MTC_t *ssb_mtc = &ft->ssb_MeasurementTimingConfiguration; NR_MeasGapConfig_t *measGapConfig = get_gap_config_from_smtc(ssb_mtc); const NR_GapConfig_t *gap_config = get_gap_config(measGapConfig); - if (!gap_config) + if (!gap_config) { + ASN_STRUCT_FREE(asn_DEF_NR_MeasGapConfig, measGapConfig); return mgc; + } mgc.mgrp_ms = get_mgrp(gap_config->mgrp); DevAssert(mgc.mgrp_ms != -1); @@ -4385,6 +4387,10 @@ measgap_config_t create_measgap_config(const NR_MeasurementTimingConfiguration_t mgc.mgl_slots = ((int)(10 * (mgc.mgl_ms + max_k2)) << scs) / 10; mgc.enable = true; + + // Free the allocated measGapConfig structure after we're done using gap_config + ASN_STRUCT_FREE(asn_DEF_NR_MeasGapConfig, measGapConfig); + return mgc; }