From 2c08302c89c50be6efe6ff75328e7e271c435071 Mon Sep 17 00:00:00 2001 From: Cedric Roux Date: Mon, 5 Sep 2022 16:29:51 +0200 Subject: [PATCH] nr rlc: fix in process_control_pdu() the following: if (cur_wait_list == entity->wait_end) end_wait_list = prev_wait_list; was done after cur_wait_list is updated to its new value, but the old value has to be used in this test. So end_wait_list was not set properly. This was leading to random crashes later on because then entity->wait_list was NULL but entity->wait_end was not (because of the bug fixed by this commit). The new value for cur_wait_list is also now set using prev_wait_list->next just before the goto, as done in other places in the code. Also "cur" was removed, for it has no purpose and makes the code harder to understand. --- openair2/LAYER2/nr_rlc/nr_rlc_entity_am.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/openair2/LAYER2/nr_rlc/nr_rlc_entity_am.c b/openair2/LAYER2/nr_rlc/nr_rlc_entity_am.c index 91e2bed11a..feb1a0905d 100644 --- a/openair2/LAYER2/nr_rlc/nr_rlc_entity_am.c +++ b/openair2/LAYER2/nr_rlc/nr_rlc_entity_am.c @@ -473,19 +473,18 @@ process_wait_list_head: * if fully acked */ if (sn_compare_tx(entity, cur_wait_list->sdu->sn, ack_sn) < 0) { - nr_rlc_sdu_segment_t *cur = cur_wait_list; - int upper_layer_id = cur->sdu->upper_layer_id; - int sdu_size = cur->sdu->size; - cur_wait_list = cur_wait_list->next; - prev_wait_list->next = cur_wait_list; + int upper_layer_id = cur_wait_list->sdu->upper_layer_id; + int sdu_size = cur_wait_list->sdu->size; + prev_wait_list->next = cur_wait_list->next; if (cur_wait_list == entity->wait_end) end_wait_list = prev_wait_list; - if (nr_rlc_free_sdu_segment(cur)) { + if (nr_rlc_free_sdu_segment(cur_wait_list)) { entity->tx_size -= sdu_size; entity->common.sdu_successful_delivery( entity->common.sdu_successful_delivery_data, (nr_rlc_entity_t *)entity, upper_layer_id); } + cur_wait_list = prev_wait_list->next; goto process_next_pdu; } @@ -594,19 +593,18 @@ nacks_done: /* current segment is acked, free it, indicate successful delivery * if fully acked */ - nr_rlc_sdu_segment_t *cur = cur_wait_list; - int upper_layer_id = cur->sdu->upper_layer_id; - int sdu_size = cur->sdu->size; + int upper_layer_id = cur_wait_list->sdu->upper_layer_id; + int sdu_size = cur_wait_list->sdu->size; prev_wait_list->next = cur_wait_list->next; if (cur_wait_list == entity->wait_end) end_wait_list = prev_wait_list; - cur_wait_list = cur_wait_list->next; - if (nr_rlc_free_sdu_segment(cur)) { + if (nr_rlc_free_sdu_segment(cur_wait_list)) { entity->tx_size -= sdu_size; entity->common.sdu_successful_delivery( entity->common.sdu_successful_delivery_data, (nr_rlc_entity_t *)entity, upper_layer_id); } + cur_wait_list = prev_wait_list->next; } /* deal with retransmit list */ while (cur_retransmit_list != NULL