maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
e33711cffa2f97567823731d75995c2547155c72
openairinterface5g/openair2/LAYER2
T
History
Robert Schmidt e33711cffa Allocate twice to avoid double free 
We use the same resource for CSI meas report and RSRP (judging by the
name of the functions), but the memory allocations need to be separate
to avoid a double free:

    ==2063066==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c27d43e3ce8 at pc 0x000000fcd279 bp 0x7be7cc9e7120 sp 0x7be7cc9e7118
    READ of size 8 at 0x7c27d43e3ce8 thread T6
        #0 0x000000fcd278 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:97
        #1 0x000000fcd278 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
        #2 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:236
        #3 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:220
        #4 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:91
        #5 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
        #6 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:185
        #7 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:158
        #8 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:91
        #9 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
        #10 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:236
        #11 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:220
        #12 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
        #13 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
        #14 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:185
        #15 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:158
        #16 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
        #17 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
        #18 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
        #19 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
        #20 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
        #21 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
        #22 0x0000009d78ae in ue_context_setup_request /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:692
        #23 0x00000083fee2 in rrc_add_nsa_user /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_nsa.c:330
        #24 0x000000886e8b in rrc_gNB_process_f1_setup_req /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_du.c:444
        #25 0x000000833942 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2766
        #26 0x7fe7d5e28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
        #27 0x7fe7d527f1d3 in start_thread (/lib64/libc.so.6+0x711d3) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
        #28 0x7fe7d5301ceb in __GI___clone3 (/lib64/libc.so.6+0xf3ceb) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)

    0x7c27d43e3ce8 is located 24 bytes inside of 40-byte region [0x7c27d43e3cd0,0x7c27d43e3cf8)
    freed by thread T6 here:
        #0 0x7fe7d5ee5bcb in free.part.0 (/lib64/libasan.so.8+0xe5bcb) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
        #1 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:236
        #2 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:220
        #3 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:91
        #4 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
        #5 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:185
        #6 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:158
        #7 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:91
        #8 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
        #9 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:236
        #10 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:220
        #11 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
        #12 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
        #13 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:185
        #14 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:158
        #15 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
        #16 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
        #17 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
        #18 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
        #19 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
        #20 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
        #21 0x0000009d78ae in ue_context_setup_request /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:692
        #22 0x00000083fee2 in rrc_add_nsa_user /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_nsa.c:330
        #23 0x000000886e8b in rrc_gNB_process_f1_setup_req /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_du.c:444
        #24 0x000000833942 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2766
        #25 0x7fe7d5e28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)

    previously allocated by thread T6 here:
        #0 0x7fe7d5ee6883 in calloc (/lib64/libasan.so.8+0xe6883) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
        #1 0x000000a1ac53 in get_default_secondaryCellGroup /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c:3969
        #2 0x0000009d8913 in create_new_UE /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:571
        #3 0x0000009d8913 in ue_context_setup_request /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:638
        #4 0x00000083fee2 in rrc_add_nsa_user /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_nsa.c:330
        #5 0x000000886e8b in rrc_gNB_process_f1_setup_req /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_du.c:444
        #6 0x000000833942 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2766
        #7 0x7fe7d5e28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)

    Thread T6 created by T0 here:
        #0 0x7fe7d5ede492 in pthread_create (/lib64/libasan.so.8+0xde492) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
        #1 0x0000012a4ba3 in threadCreate /home/richie/w/f1-refactor-ue-context/common/utils/system.c:283
        #2 0x0000006b5fef in itti_create_task /home/richie/w/f1-refactor-ue-context/common/utils/ocp_itti/intertask_interface.cpp:317
        #3 0x000000435c5f in create_gNB_tasks /home/richie/w/f1-refactor-ue-context/executables/nr-softmodem.c:310
        #4 0x000000435c5f in main /home/richie/w/f1-refactor-ue-context/executables/nr-softmodem.c:620
        #5 0x7fe7d52115f4 in __libc_start_call_main (/lib64/libc.so.6+0x35f4) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
        #6 0x7fe7d52116a7 in __libc_start_main@@GLIBC_2.34 (/lib64/libc.so.6+0x36a7) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
        #7 0x0000004672d4 in _start (/home/richie/w/f1-refactor-ue-context/build/nr-softmodem+0x4672d4) (BuildId: 81450e9a0b832ca9e36b1984ecc232efde59d424)

Closes: #958
2025-06-28 12:19:58 +02:00
..
MAC
do not compile full LTE L2 eNB in nr-softmodem (at the cost of a small dummy file)
2025-03-25 08:27:12 +01:00
NR_MAC_COMMON
Fix data race in NR UE MSG3 scheduling
2025-06-03 14:41:06 +02:00
NR_MAC_gNB
Allocate twice to avoid double free
2025-06-28 12:19:58 +02:00
NR_MAC_UE
Merge remote-tracking branch 'origin/NR_NTN_ulsyncduration' into integration_2025_w25 (!3367)
2025-06-19 08:25:28 +02:00
nr_pdcp
nr pdcp security: add a 'decipher' API function
2025-06-23 10:02:54 +02:00
nr_rlc
store RB information in LCID structure at UE
2025-06-13 16:46:21 +02:00
PDCP_v10.1.0
Refactor tun_if.h
2025-02-07 12:25:35 +01:00
RLC
rlc.h cleanup
2025-04-01 11:46:58 +02:00
rlc_v2
print rnti as hexadecimal
2024-10-22 11:05:20 +02:00
CMakeLists.txt
snow3g: add a test program
2024-09-19 10:40:55 +02:00
openair2_proc.c
Make separate header for nr_pdcp instead of using 4G pdcp
2023-03-27 16:39:24 +02:00