From 4958f8b6d7816b2ad7f180aef8abbf96d91a4760 Mon Sep 17 00:00:00 2001 From: Laurent THOMAS Date: Thu, 11 Jan 2024 15:09:24 +0100 Subject: [PATCH 1/2] segv on null pointer --- openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_RA.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_RA.c b/openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_RA.c index 425782cddc..e49c0b3730 100644 --- a/openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_RA.c +++ b/openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_RA.c @@ -839,10 +839,9 @@ static void nr_generate_Msg3_retransmission(module_id_t module_idP, dci_pdu->beta_PDCCH_1_0 = 0; dci_pdu->powerControlOffsetSS = 1; - dci_pdu_rel15_t uldci_payload; - memset(&uldci_payload, 0, sizeof(uldci_payload)); + dci_pdu_rel15_t uldci_payload={0}; - config_uldci(NULL, + config_uldci(sc_info, pusch_pdu, &uldci_payload, NULL, From f24cff929e45d1cdee2c56e10eb0d423339afcda Mon Sep 17 00:00:00 2001 From: Laurent THOMAS Date: Thu, 11 Jan 2024 15:04:56 +0100 Subject: [PATCH 2/2] make better version of nr_get_msg3_payload() --- openair2/LAYER2/NR_MAC_UE/mac_proto.h | 2 +- openair2/LAYER2/NR_MAC_UE/nr_ra_procedures.c | 40 ++++++++------------ openair2/LAYER2/NR_MAC_UE/nr_ue_scheduler.c | 3 +- 3 files changed, 18 insertions(+), 27 deletions(-) diff --git a/openair2/LAYER2/NR_MAC_UE/mac_proto.h b/openair2/LAYER2/NR_MAC_UE/mac_proto.h index 54a10bfab6..ab5cae1a63 100644 --- a/openair2/LAYER2/NR_MAC_UE/mac_proto.h +++ b/openair2/LAYER2/NR_MAC_UE/mac_proto.h @@ -502,7 +502,7 @@ void set_ra_rnti(NR_UE_MAC_INST_t *mac, fapi_nr_ul_config_prach_pdu *prach_pdu); void nr_Msg1_transmitted(module_id_t mod_id); void nr_Msg3_transmitted(module_id_t mod_id, uint8_t CC_id, frame_t frameP, slot_t slotP, uint8_t gNB_id); -void nr_get_msg3_payload(module_id_t mod_id); +void nr_get_msg3_payload(module_id_t mod_id, uint8_t *buf, int TBS_max); void send_msg3_rrc_request(module_id_t mod_id, int rnti); void nr_ue_msg2_scheduler(module_id_t mod_id, uint16_t rach_frame, uint16_t rach_slot, uint16_t *msg2_frame, uint16_t *msg2_slot); diff --git a/openair2/LAYER2/NR_MAC_UE/nr_ra_procedures.c b/openair2/LAYER2/NR_MAC_UE/nr_ra_procedures.c index b9d9f7a8fc..5a80122d67 100644 --- a/openair2/LAYER2/NR_MAC_UE/nr_ra_procedures.c +++ b/openair2/LAYER2/NR_MAC_UE/nr_ra_procedures.c @@ -608,23 +608,25 @@ void nr_Msg3_transmitted(module_id_t mod_id, uint8_t CC_id, frame_t frameP, slot ra->ra_state = WAIT_CONTENTION_RESOLUTION; } -void nr_get_msg3_payload(module_id_t mod_id) +void nr_get_msg3_payload(module_id_t mod_id, uint8_t *buf, int TBS_max) { NR_UE_MAC_INST_t *mac = get_mac_inst(mod_id); RA_config_t *ra = &mac->ra; - uint8_t *pdu = mac->CCCH_pdu.payload; - const uint8_t sh_size = sizeof(NR_MAC_SUBHEADER_FIXED); - NR_MAC_SUBHEADER_FIXED *header = (NR_MAC_SUBHEADER_FIXED *) pdu; - pdu += sh_size; - int lcid = 0; // SRB0 for messages sent in MSG3 + uint8_t *pdu = buf; + *(NR_MAC_SUBHEADER_FIXED *)pdu = (NR_MAC_SUBHEADER_FIXED){.LCID = UL_SCH_LCID_CCCH}; + pdu += sizeof(NR_MAC_SUBHEADER_FIXED); + // here a big race condition: nothing ensure RRC thread has already pushed data to rlc + // there is no issue inside RLC, + // if RRC has called nr_rlc_srb_recv_sdu(), + // we are good even if the name is misleading (we send a ssrb msg, not receive if) tbs_size_t len = mac_rlc_data_req(mod_id, ra->t_crnti, 0, 0, ENB_FLAG_NO, MBMS_FLAG_NO, - lcid, - 16, /* size of mac_ce above */ + 0, // SRB0 for messages sent in MSG3 + TBS_max - sizeof(NR_MAC_SUBHEADER_FIXED), /* size of mac_ce above */ (char *)pdu, 0, 0); @@ -632,26 +634,16 @@ void nr_get_msg3_payload(module_id_t mod_id) // UE Contention Resolution Identity // Store the first 48 bits belonging to the uplink CCCH SDU within Msg3 to determine whether or not the // Random Access Procedure has been successful after reception of Msg4 + // We copy from persisted memory to another persisted memory memcpy(ra->cont_res_id, pdu, sizeof(uint8_t) * 6); pdu += len; - int Msg3_size = len + sh_size; - // Build header - header->R = 0; - header->LCID = UL_SCH_LCID_CCCH; - const uint8_t TBS_max = 8 + sizeof(NR_MAC_SUBHEADER_SHORT) + sizeof(NR_MAC_SUBHEADER_SHORT); // Note: unclear the reason behind the selection of such TBS_max + AssertFatal(TBS_max >= pdu - buf, "Allocated resources are not enough for Msg3!\n"); // Padding: fill remainder with 0 - if (TBS_max - Msg3_size > 0) { - AssertFatal(TBS_max > Msg3_size, "Allocated resources are not enough for Msg3!\n"); - LOG_D(NR_MAC, "Remaining %d bytes, filling with padding\n",TBS_max - Msg3_size); - ((NR_MAC_SUBHEADER_FIXED *) pdu)->R = 0; - ((NR_MAC_SUBHEADER_FIXED *) pdu)->LCID = UL_SCH_LCID_PADDING; + LOG_D(NR_MAC, "Remaining %ld bytes, filling with padding\n", pdu - buf); + while (pdu < buf + TBS_max - sizeof(NR_MAC_SUBHEADER_FIXED)) { + *(NR_MAC_SUBHEADER_FIXED *)pdu = (NR_MAC_SUBHEADER_FIXED){.LCID = UL_SCH_LCID_PADDING}; pdu += sizeof(NR_MAC_SUBHEADER_FIXED); - memset(pdu, 0, TBS_max - Msg3_size - sizeof(NR_MAC_SUBHEADER_FIXED)); } - // Dumping ULSCH payload - LOG_D(NR_MAC, "Dumping UL Msg3 MAC PDU with length %d: \n", TBS_max); - for(int k = 0; k < TBS_max; k++) - LOG_D(NR_MAC,"(%i): %i\n", k, pdu[k]); } /** @@ -710,7 +702,7 @@ uint8_t nr_ue_get_rach(module_id_t mod_id, int size_sdu = 0; uint8_t mac_ce[16] = {0}; uint8_t *pdu = get_softmodem_params()->sa ? mac->CCCH_pdu.payload : mac_ce; - uint8_t *payload = pdu; + const uint8_t *payload = pdu; // Concerning the C-RNTI MAC CE, it has to be included if the UL transmission (Msg3) is not being made for the CCCH logical channel. // Therefore it has been assumed that this event only occurs only when RA is done and it is not SA mode. diff --git a/openair2/LAYER2/NR_MAC_UE/nr_ue_scheduler.c b/openair2/LAYER2/NR_MAC_UE/nr_ue_scheduler.c index 75e959f6cc..51cb1a0bbb 100644 --- a/openair2/LAYER2/NR_MAC_UE/nr_ue_scheduler.c +++ b/openair2/LAYER2/NR_MAC_UE/nr_ue_scheduler.c @@ -1036,8 +1036,7 @@ void nr_ue_ul_scheduler(nr_uplink_indication_t *ul_info) ulcfg_pdu->pusch_config_pdu.pusch_data.new_data_indicator, TBS_bytes,ra->ra_state); if (ra->ra_state == WAIT_RAR && !ra->cfra) { - nr_get_msg3_payload(mod_id); - memcpy(ulsch_input_buffer, mac->CCCH_pdu.payload, TBS_bytes); + nr_get_msg3_payload(mod_id, ulsch_input_buffer, TBS_bytes); for (int k = 0; k < TBS_bytes; k++) { LOG_D(NR_MAC,"(%i): 0x%x\n", k, ulsch_input_buffer[k]); }