Skip to content

Malformed Messages can cause DU Crash #108

Open
Open
Malformed Messages can cause DU Crash#108

Description

@sgarg00
sgarg00
opened on Jun 5, 2026

Originally reported by XIAOTIAN ZHOU on 2026-05-09 — GitLab #1090

Hi, similar to #1078 and #1089, we found another batch of inputs that could cause the DU to crash. These are listed below:

  1. Certain inputs can cause AssertFatal(du_cell->nr_cellid == cu_cell->nr_cellid, "CellID mismatch: DU %ld vs CU %ld\n", du_cell->nr_cellid, cu_cell->nr_cellid); in f1_setup_response in openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c.
    Example input: 400100210000030003000f00000004000900226377cc867d51e000aa000120004e000200de or
<F1AP-PDU>
  <successfulOutcome>
    <procedureCode>1</procedureCode>
    <criticality>
      <reject/>
    </criticality>
    <value>
      <F1SetupResponse>
        <protocolIEs>
          <ProtocolIE-Field>
            <id>3</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <Cells-to-be-Activated-List>
                <ProtocolIE-SingleContainer>
                  <id>4</id>
                  <criticality>
                    <reject/>
                  </criticality>
                  <value>
                    <Cells-to-be-Activated-List-Item>
                      <nRCGI>
                        <pLMN-Identity>226377</pLMN-Identity>
                        <nRCellIdentity>110011001000011001111101010100011110</nRCellIdentity>
                      </nRCGI>
                    </Cells-to-be-Activated-List-Item>
                  </value>
                </ProtocolIE-SingleContainer>
              </Cells-to-be-Activated-List>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>170</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <RRC-Version>
                <latest-RRC-Version>010</latest-RRC-Version>
              </RRC-Version>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>78</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <TransactionID>222</TransactionID>
            </value>
          </ProtocolIE-Field>
        </protocolIEs>
      </F1SetupResponse>
    </value>
  </successfulOutcome>
</F1AP-PDU>
  1. Certain inputs can cause:
    AssertFatal(1==0,"received gNB CU CONFIGURATION UPDATE FAILURE with cause %d\n", GNBCUConfigurationUpdateFailure->cause) in DU_send_gNB_CU_CONFIGURATION_UPDATE_FAILURE in openair2/F1AP/f1ap_du_interface_management.c.
    Example input: 0004001c0000020003000f00000004000900226377cc867d51e0004e0002008a or
<F1AP-PDU>
  <initiatingMessage>
    <procedureCode>4</procedureCode>
    <criticality>
      <reject/>
    </criticality>
    <value>
      <GNBCUConfigurationUpdate>
        <protocolIEs>
          <ProtocolIE-Field>
            <id>3</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <Cells-to-be-Activated-List>
                <ProtocolIE-SingleContainer>
                  <id>4</id>
                  <criticality>
                    <reject/>
                  </criticality>
                  <value>
                    <Cells-to-be-Activated-List-Item>
                      <nRCGI>
                        <pLMN-Identity>226377</pLMN-Identity>
                        <nRCellIdentity>110011001000011001111101010100011110</nRCellIdentity>
                      </nRCGI>
                    </Cells-to-be-Activated-List-Item>
                  </value>
                </ProtocolIE-SingleContainer>
              </Cells-to-be-Activated-List>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>78</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <TransactionID>138</TransactionID>
            </value>
          </ProtocolIE-Field>
        </protocolIEs>
      </GNBCUConfigurationUpdate>
    </value>
  </initiatingMessage>
</F1AP-PDU>
  1. Certain inputs can cause: AssertFatal(cell_to_activate == 1,"No cells to activate or cells > 1 %d\n",cell_to_activate); in gNB_app_task in openair2/GNB_APP/gnb_app.c.
    Example input:
    0004001c0000020003000f00000004000900226377cc867d51e0004e0002008a or
<F1AP-PDU>
  <initiatingMessage>
    <procedureCode>4</procedureCode>
    <criticality>
      <reject/>
    </criticality>
    <value>
      <GNBCUConfigurationUpdate>
        <protocolIEs>
          <ProtocolIE-Field>
            <id>3</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <Cells-to-be-Activated-List>
                <ProtocolIE-SingleContainer>
                  <id>4</id>
                  <criticality>
                    <reject/>
                  </criticality>
                  <value>
                    <Cells-to-be-Activated-List-Item>
                      <nRCGI>
                        <pLMN-Identity>226377</pLMN-Identity>
                        <nRCellIdentity>110011001000011001111101010100011110</nRCellIdentity>
                      </nRCGI>
                    </Cells-to-be-Activated-List-Item>
                  </value>
                </ProtocolIE-SingleContainer>
              </Cells-to-be-Activated-List>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>78</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <TransactionID>138</TransactionID>
            </value>
          </ProtocolIE-Field>
        </protocolIEs>
      </GNBCUConfigurationUpdate>
    </value>
  </initiatingMessage>
</F1AP-PDU>
  1. Certain input can trigger: AssertFatal(is_SA ^ (cg_configinfo != NULL), "cannot have SA and CG-ConfigInfo: NR-DC not supported xor need CG-ConfigInfo for NSA/phy-test/do-ra\n"); in ue_context_setup_request in openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c.
    Example input:
    000500260000040009000440029946006b000108003f0009002427226377cc86f000280005c0130af08a or
  <initiatingMessage>
    <procedureCode>5</procedureCode>
    <criticality>
      <reject/>
    </criticality>
    <value>
      <UEContextSetupRequest>
        <protocolIEs>
          <ProtocolIE-Field>
            <id>9</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <CUtoDURRCInformation>
                <cG-ConfigInfo>9946</cG-ConfigInfo>
              </CUtoDURRCInformation>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>107</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <ServCellIndex>2</ServCellIndex>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>63</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <NRCGI>
                <pLMN-Identity>242722</pLMN-Identity>
                <nRCellIdentity>011000110111011111001100100001101111</nRCellIdentity>
              </NRCGI>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>40</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <GNB-CU-UE-F1AP-ID>319484042</GNB-CU-UE-F1AP-ID>
            </value>
          </ProtocolIE-Field>
        </protocolIEs>
      </UEContextSetupRequest>
    </value>
  </initiatingMessage>
</F1AP-PDU>
  1. Some inputs can trigger AssertFatal(rb != NULL, "SDU sent to unknown RB UE-ID %d SRB %d\n", ue_id, channel_id); in nr_rlc_srb_recv_sdu in openair2/LAYER2/nr_rlc/nr_rlc_oai_api.c. Example input:
    0005002a000005000900010000320003022427006b000108003f0009006377cc867d51adc000280005c08ad13451 or
<F1AP-PDU>
  <initiatingMessage>
    <procedureCode>5</procedureCode>
    <criticality>
      <reject/>
    </criticality>
    <value>
      <UEContextSetupRequest>
        <protocolIEs>
          <ProtocolIE-Field>
            <id>9</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <CUtoDURRCInformation/>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>50</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <RRCContainer>2427</RRCContainer>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>107</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <ServCellIndex>2</ServCellIndex>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>63</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <NRCGI>
                <pLMN-Identity>6377CC</pLMN-Identity>
                <nRCellIdentity>100001100111110101010001101011011100</nRCellIdentity>
              </NRCGI>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>40</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <GNB-CU-UE-F1AP-ID>2328966225</GNB-CU-UE-F1AP-ID>
            </value>
          </ProtocolIE-Field>
        </protocolIEs>
      </UEContextSetupRequest>
    </value>
  </initiatingMessage>
</F1AP-PDU>
  1. Certain message may cause Null Pointer Dereference. In ue_cap = get_ue_nr_cap(*req->gNB_DU_ue_id, cu2du->ue_cap->buf, cu2du->ue_cap->len); in function ue_context_setup_request, the req->gNB_DU_ue_id might be NULL.
    Example input: 0005003b00000501020011010103000c5444800027161201867d51c0000900042002f21e006b000108003f0009000af08ad13451dea000280005c0b23076fd
<F1AP-PDU>
  <initiatingMessage>
    <procedureCode>5</procedureCode>
    <criticality>
      <reject/>
    </criticality>
    <value>
      <UEContextSetupRequest>
        <protocolIEs>
          <ProtocolIE-Field>
            <id>258</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <BHChannels-ToBeSetup-List>
                <ProtocolIE-SingleContainer>
                  <id>259</id>
                  <criticality>
                    <reject/>
                  </criticality>
                  <value>
                    <BHChannels-ToBeSetup-Item>
                      <bHRLCChannelID>1010001000100100</bHRLCChannelID>
                      <bHQoSInformation>
                        <bHRLCCHQoS>
                          <qoS-Characteristics>
                            <non-Dynamic-5QI>
                              <fiveQI>39</fiveQI>
                            </non-Dynamic-5QI>
                          </qoS-Characteristics>
                          <nGRANallocationRetentionPriority>
                            <priorityLevel>2</priorityLevel>
                            <pre-emptionCapability>
                              <may-trigger-pre-emption/>
                            </pre-emptionCapability>
                            <pre-emptionVulnerability>
                              <pre-emptable/>
                            </pre-emptionVulnerability>
                          </nGRANallocationRetentionPriority>
                        </bHRLCCHQoS>
                      </bHQoSInformation>
                      <rLCmode>
                        <rlc-am/>
                      </rLCmode>
                      <trafficMappingInfo>
                        <bAPlayerBHRLCchannelMappingInfo>
                          <bAPlayerBHRLCchannelMappingInfoToRemove>
                            <MappingInformationIndex>10000110011111010101000111</MappingInformationIndex>
                          </bAPlayerBHRLCchannelMappingInfoToRemove>
                        </bAPlayerBHRLCchannelMappingInfo>
                      </trafficMappingInfo>
                    </BHChannels-ToBeSetup-Item>
                  </value>
                </ProtocolIE-SingleContainer>
              </BHChannels-ToBeSetup-List>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>9</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <CUtoDURRCInformation>
                <uE-CapabilityRAT-ContainerList>F21E</uE-CapabilityRAT-ContainerList>
              </CUtoDURRCInformation>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>107</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <ServCellIndex>2</ServCellIndex>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>63</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <NRCGI>
                <pLMN-Identity>0AF08A</pLMN-Identity>
                <nRCellIdentity>110100010011010001010001110111101010</nRCellIdentity>
              </NRCGI>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>40</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <GNB-CU-UE-F1AP-ID>2989520637</GNB-CU-UE-F1AP-ID>
            </value>
          </ProtocolIE-Field>
        </protocolIEs>
      </UEContextSetupRequest>
    </value>
  </initiatingMessage>
</F1AP-PDU>
  1. AssertFatal(1==0,"Unknown reset type\n"); can be triggered in DU_handle_RESET. Example input:
    000000170000030000000580a22400000030000100004e00020022 or
<F1AP-PDU>
  <initiatingMessage>
    <procedureCode>0</procedureCode>
    <criticality>
      <reject/>
    </criticality>
    <value>
      <Reset>
        <protocolIEs>
          <ProtocolIE-Field>
            <id>0</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <Cause>
                <choice-extension>
                  <id>41508</id>
                  <criticality>
                    <reject/>
                  </criticality>
                  <value/>
                </choice-extension>
              </Cause>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>48</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <ResetType>
                <f1-Interface>
                  <reset-all/>
                </f1-Interface>
              </ResetType>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>78</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <TransactionID>34</TransactionID>
            </value>
          </ProtocolIE-Field>
        </protocolIEs>
      </Reset>
    </value>
  </initiatingMessage>
</F1AP-PDU>
  1. Assertion failure due to BIT_STRING size cannot convert to u64 or u32 in functions BIT_STRING_to_uint64 and BIT_STRING_to_uint32.
    Example inputs: 001200250000030071000f00000070000900a22427226377cc70007f0005603f134000007500027820 or
<F1AP-PDU>
  <initiatingMessage>
    <procedureCode>18</procedureCode>
    <criticality>
      <reject/>
    </criticality>
    <value>
      <Paging>
        <protocolIEs>
          <ProtocolIE-Field>
            <id>113</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <PagingCell-list>
                <ProtocolIE-SingleContainer>
                  <id>112</id>
                  <criticality>
                    <reject/>
                  </criticality>
                  <value>
                    <PagingCell-Item>
                      <nRCGI>
                        <pLMN-Identity>A22427</pLMN-Identity>
                        <nRCellIdentity>001000100110001101110111110011000111</nRCellIdentity>
                      </nRCGI>
                    </PagingCell-Item>
                  </value>
                </ProtocolIE-SingleContainer>
              </PagingCell-list>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>127</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <PagingIdentity>
                <cNUEPagingIdentity>
                  <choice-extension>
                    <id>16147</id>
                    <criticality>
                      <ignore/>
                    </criticality>
                    <value/>
                  </choice-extension>
                </cNUEPagingIdentity>
              </PagingIdentity>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>117</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <UEIdentityIndexValue>
                <indexLength10>1111000001</indexLength10>
              </UEIdentityIndexValue>
            </value>
          </ProtocolIE-Field>
        </protocolIEs>
      </Paging>
    </value>
  </initiatingMessage>
</F1AP-PDU>
  1. Function f1_setup_failure in openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c would exit(1) on any F1SetupFailure from CU.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions