Heap-use-after-free in UE for LDPC decoder
@velumani I tag you since I think you worked on that, and git blame
shows your name. Can you please have a look at this.
When compiling with address sanitizer (./build_oai --sanitize-address
) and with iperf DL traffic, I get the following heap-use-after-free error. Note that this happens when we have a CRC NOT OK
message (the message is not very clear, by the way). This issue seems to happen faster (?) when not using retransmissions, i.e., running nr-softmodem --MACRLCs.[0].dl_harq_round_max 1
.
[PHY] 679.0 CRC NOT OK
[PHY] 681.0 CRC NOT OK
=================================================================
==256898==ERROR: AddressSanitizer: heap-use-after-free on address 0x625003b3a6d1 at pc 0x5568f1364d36 bp 0x7f81a31b5ef0 sp 0x7f81a31b5ee0
READ of size 1 at 0x625003b3a6d1 thread T3
#0 0x5568f1364d35 in nr_processDLSegment ../../../openair1/PHY/NR_UE_TRANSPORT/nr_dlsch_decoding.c:284
#1 0x5568f12b6225 in one_thread ../../../common/utils/threadPool/thread-pool.c:86
#2 0x7f81a92b9608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
#3 0x7f81a8174132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
0x625003b3a6d1 is located 9681 bytes inside of 9816-byte region [0x625003b38100,0x625003b3a758)
freed by thread T6 here:
#0 0x7f81aa0c940f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
#1 0x5568f12b6b04 in delNotifiedFIFO_elt ../../../common/utils/threadPool/thread-pool.h:102
#2 0x5568f12b6b04 in one_thread ../../../common/utils/threadPool/thread-pool.c:102
#3 0x7f81a92b9608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
previously allocated by thread T13 here:
#0 0x7f81aa0c9a06 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:153
#1 0x5568f11fcb30 in newNotifiedFIFO_elt ../../../common/utils/threadPool/thread-pool.h:84
#2 0x5568f11fcb30 in UE_thread ../../../executables/nr-ue.c:964
#3 0x7f81a92b9608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
Thread T3 created by T0 here:
#0 0x7f81a9ff6815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
#1 0x5568f12badeb in threadCreate ../../../common/utils/system.c:262
#2 0x5568f12b8304 in initNamedTpool ../../../common/utils/threadPool/thread-pool.c:153
#3 0x5568f11c3748 in main ../../../executables/nr-uesoftmodem.c:453
#4 0x7f81a8079082 in __libc_start_main ../csu/libc-start.c:308
Thread T6 created by T0 here:
#0 0x7f81a9ff6815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
#1 0x5568f12badeb in threadCreate ../../../common/utils/system.c:262
#2 0x5568f12b8304 in initNamedTpool ../../../common/utils/threadPool/thread-pool.c:153
#3 0x5568f11c3748 in main ../../../executables/nr-uesoftmodem.c:453
#4 0x7f81a8079082 in __libc_start_main ../csu/libc-start.c:308
Thread T13 created by T0 here:
#0 0x7f81a9ff6815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
#1 0x5568f12badeb in threadCreate ../../../common/utils/system.c:262
#2 0x5568f1204715 in init_NR_UE_threads ../../../executables/nr-ue.c:1015
#3 0x5568f11c5ab2 in main ../../../executables/nr-uesoftmodem.c:548
#4 0x7f81a8079082 in __libc_start_main ../csu/libc-start.c:308
SUMMARY: AddressSanitizer: heap-use-after-free ../../../openair1/PHY/NR_UE_TRANSPORT/nr_dlsch_decoding.c:284 in nr_processDLSegment
Shadow bytes around the buggy address:
0x0c4a8075f480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a8075f490: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a8075f4a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a8075f4b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a8075f4c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c4a8075f4d0: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd
0x0c4a8075f4e0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x0c4a8075f4f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c4a8075f500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c4a8075f510: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c4a8075f520: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==256898==ABORTING