maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/rrc-race-condition' into integration_2026_w08 (!3925)

Browse Source 
Fix race condition on double RA during RRC reestablishment

Sometimes, especially in poor channel conditions, a UE can trigger
multiple RA procedures during RRC reestablishment, causing
reconfigCellGroup to be overwritten with a CellGroup that already has
spCellConfig removed, leading to an assertion failure in
update_cellgroup_for_reestablishment(). See logs below

    [NR_MAC]  456.13 UE 991d: Received Ack of Msg4. CBRA procedure succeeded (UE Connected)
    [NR_MAC] Adding new UE context with RNTI 0x991d
    [NR_PHY] [RAPROC] 461.9 Initiating RA procedure with preamble 8, energy 48.0 dB (I0 274, thres 130), delay 21 start symbol 2 freq index 0
    [NR_MAC] 461.9 UE RA-RNTI 0081 TC-RNTI ecd8: initiating RA procedure
    [NR_MAC] UE ecd8: Sync beam index 0
    [NR_MAC] UE ecd8: Msg3 scheduled at 462.3 (461.18 TDA 2) start 0 RBs 8
    [NR_MAC] UE ecd8: 461.18 Generating RA-Msg2 DCI, RA RNTI 0x81, state 1, preamble_index(RAPID) 8, timing_offset = 21 (estimated distance 820.3 [m])
    [NR_MAC]  462. 3 PUSCH with TC_RNTI 0xecd8 received correctly
    [NR_MAC] Received a MAC CE for C-RNTI with 991d
    [NR_MAC] Remove NR rnti 0xecd8
    [NR_MAC]  462. 3 RA with C-RNTI 991d complete
    [NR_PHY] [RAPROC] 471.19 Initiating RA procedure with preamble 6, energy 51.0 dB (I0 276, thres 130), delay 21 start symbol 2 freq index 0
    [NR_MAC] 471.19 UE RA-RNTI 010d TC-RNTI 022d: initiating RA procedure
    [NR_MAC] UE 022d: Sync beam index 0
    [NR_MAC] UE 022d: Msg3 scheduled at 472.13 (472.8 TDA 2) start 0 RBs 8
    [NR_MAC] UE 022d: 472.8 Generating RA-Msg2 DCI, RA RNTI 0x10d, state 1, preamble_index(RAPID) 6, timing_offset = 21 (estimated distance 820.3 [m])
    [NR_MAC]  472.13 PUSCH with TC_RNTI 0x022d received correctly
    [NR_MAC] Received a MAC CE for C-RNTI with 991d
    [NR_MAC] Remove NR rnti 0x022d
    [NR_MAC]  472.13 RA with C-RNTI 991d complete
    [NR_RRC] [UL] (cellID 1, UE ID 1 RNTI 991d) Received RRCReestablishmentComplete
    [NR_RRC] UE 1 Processing NR_RRCReestablishmentComplete from UE
    [NR_MAC] UE 991d: gNB-DU Configuration Query received, will include CellGroupConfig in response

    Assertion (new_CellGroup->spCellConfig) failed!
    In update_cellgroup_for_reestablishment() /phy/openairinterface5g/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:666

This MR solves it by skipping the reconfigCellGroup overwrite when it
already holds a valid config with spCellConfig, and by replacing the
fatal assertion on missing spCellConfig with an early return.
This commit is contained in:
Robert Schmidt
2026-02-17 18:16:27 +01:00
parent a264937825 37cb854319
commit 3520eb3c0d
1 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c
+21 -5
View File
@@ -663,8 +663,12 @@ static NR_CellGroupConfig_t *get_cellgroup_config(NR_UE_info_t *UE)
static void update_cellgroup_for_reestablishment(NR_UE_info_t *UE, NR_CellGroupConfig_t *new_CellGroup)
{
DevAssert(new_CellGroup);
DevAssert(new_CellGroup->spCellConfig);
DevAssert(UE->reestablish_rlc);
if (!new_CellGroup->spCellConfig) {
LOG_E(NR_MAC, "UE %04x: CellGroupConfig has no spCellConfig during reestablishment "
"(possible double reestablishment race), skipping reestablishRLC update\n", UE->rnti);
return;
}
LOG_I(NR_MAC, "UE %04x: Re-establishment detected, setting reestablishRLC flags\n", UE->rnti);
struct NR_CellGroupConfig__rlc_BearerToAddModList *addmod = new_CellGroup->rlc_BearerToAddModList;
if (addmod && addmod->list.count > 0) {
@@ -1079,6 +1083,10 @@ void dl_rrc_message_transfer(const f1ap_dl_rrc_message_t *dl_rrc)
ASN_STRUCT_FREE(asn_DEF_NR_CellGroupConfig, UE->CellGroup);
UE->CellGroup = oldUE->CellGroup;
oldUE->CellGroup = NULL;
ASN_STRUCT_FREE(asn_DEF_NR_CellGroupConfig, UE->reconfigCellGroup);
UE->reconfigCellGroup = oldUE->reconfigCellGroup;
oldUE->reconfigCellGroup = NULL;
UE->reestablish_rlc = oldUE->reestablish_rlc;
ASN_STRUCT_FREE(asn_DEF_NR_UE_NR_Capability, UE->capability);
UE->capability = oldUE->capability;
oldUE->capability = NULL;
@@ -1095,10 +1103,18 @@ void dl_rrc_message_transfer(const f1ap_dl_rrc_message_t *dl_rrc)
}
/* Per TS 38.331 5.3.7.2: the UE releases the spCellConfig, so we drop it
* from the current configuration. It will be reapplied when the
* reconfiguration has succeeded (indicated by the CU) */
asn_copy(&asn_DEF_NR_CellGroupConfig, (void **)&UE->reconfigCellGroup, UE->CellGroup);
ASN_STRUCT_FREE(asn_DEF_NR_SpCellConfig, UE->CellGroup->spCellConfig);
UE->CellGroup->spCellConfig = NULL;
* reconfiguration has succeeded (indicated by the CU).
* Guard against double reestablishment: if reestablish_rlc is already set,
* reconfigCellGroup was saved by the first reestablishment and
* CellGroup.spCellConfig is already NULL — don't overwrite. */
if (!UE->reestablish_rlc) {
asn_copy(&asn_DEF_NR_CellGroupConfig, (void **)&UE->reconfigCellGroup, UE->CellGroup);
ASN_STRUCT_FREE(asn_DEF_NR_SpCellConfig, UE->CellGroup->spCellConfig);
UE->CellGroup->spCellConfig = NULL;
} else {
LOG_W(NR_MAC, "UE %04x: reestablishment while previous reestablishment still pending, "
"keeping saved reconfigCellGroup with spCellConfig\n", UE->rnti);
}
UE->reestablish_rlc = true;
/* Per TS 38.331 clause 5.3.7.4: apply gNB RLC configuration for SRB1 to match the UE RLC configuration defined in 9.2.1.
* Use configuration file values for timers t_poll_retransmit, t_reassembly and t_status_prohibit */