maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

NR_UE: always break out of MAC PDU processing after pdu_len Bytes

Browse Source 
In case of false positive PDSCH CRC check, a random MAC PDU is processed.
Currently pdu_len is unsigned 16 Bit, so we did break out of the processing loop only if we _exactly_ hit a residual pdu_len of 0, or we hit a LCID of DL_SCH_LCID_PADDING.
If we didn't hit either of these, pdu_len wrapped to a very positive value, and we continued processing the PDU even beyond its bounds!
This behavior was observed with SNR 1 dB and MCS 9.

So better make pdu_len signed and break out of the loop after processing at max. pdu_len Bytes!
This commit is contained in:
Thomas Schlichter
2021-03-19 17:45:14 +01:00
parent 14f3d6a77a
commit bc041092c8
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openair1/SCHED_NR_UE/phy_procedures_nr_ue.c
+1 -1
View File
@@ -881,7 +881,7 @@ void nr_ue_dlsch_procedures(PHY_VARS_NR_UE *ue,
int harq_pid = dlsch0->current_harq_pid;
int frame_rx = proc->frame_rx;
int nr_slot_rx = proc->nr_slot_rx;
int ret=0, ret1=0;
uint32_t ret = UINT32_MAX, ret1 = UINT32_MAX;
NR_UE_PDSCH *pdsch_vars;
uint16_t dmrs_len = get_num_dmrs(dlsch0->harq_processes[dlsch0->current_harq_pid]->dlDmrsSymbPos);
nr_downlink_indication_t dl_indication;