In scripts/conf_files, restore ue.nfapi.conf and nr-ue.nfapi.conf
to the template versions. And add proxy_ue.nfapi.conf
proxy_nr-ue.nfapi.conf for use with emane.git's run-oai and
multi-ue-proxy.git's run-oai.
Most notably, nfapi_rx_indication_pdu_t.data type is changed from
`uint8_t*` to `uint8_t[]`. Also, renamed from `data` to
`rx_ind_data` to make it easier to find.
assert() statements were enabled for C code but disabled for C++
code. With this commit, assert() is enabled for both C and C++
for RelWithDebInfo builds.
With a small number of runs with 16 UEs, I've seen this
AssertFatal fail twice.
There are many other places in the code that simply skip over
ulsch[i] values that are NULL.
This code allocates memory from the heap:
```
static void *UE_phy_stub_standalone_pnf_task(void *arg)
{
...
UL_INFO->crc_ind.crc_indication_body.crc_pdu_list =
calloc(NB_UE_INST, sizeof(nfapi_crc_indication_pdu_t));
```
I see NB_UE_INST==1.
Then this code:
```
void fill_crc_indication_UE_MAC(int Mod_id,
int frame,
int subframe,
UL_IND_t *UL_INFO,
uint8_t crc_flag,
int index,
uint16_t rnti,
nfapi_ul_config_request_t
*ul_config_req) {
...
nfapi_crc_indication_pdu_t *pdu =
&UL_INFO->crc_ind.crc_indication_body
.crc_pdu_list[UL_INFO->crc_ind.crc_indication_body.number_of_crcs];
```
used .number_of_crcs to index into .crc_pdu_list without first
checking if .number_of_crcs is in range.
When run with multiple UEs, sometimes .number_of_crcs==1 and then
-fsanitize=address complains.
Change is to use NUMBER_OF_UE_MAX instead of NB_UE_INST.
With this change, -fsanitize=address stopping complaining.
-fsanitize=address detected that we were trying to access bytes
past the end of a block of malloc'ed memory.
Specifically, in this code:
```
} else if (ENB_NAS_USE_TUN) {
if( LOG_DEBUGFLAG(DEBUG_PDCP) )
log_dump(PDCP, pdcpData, sizeToWrite, LOG_DUMP_CHAR,"PDCP
output to be sent to TUN interface: \n");
ret = write(nas_sock_fd[0], pdcpData, sizeToWrite);
```
-fsanitize=address said:
```
==80==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x61100004ffdc at pc 0x7f57c5f576a5 bp 0x7f57bb53c240 sp
0x7f57bb53b9e8
READ of size 108 at 0x61100004ffdc thread T7
0x61100004ffdc is located 0 bytes to the right of 220-byte region
[0x61100004ff00,0x61100004ffdc)
```
So, the code was trying to access the first byte after a block of
heap memory.
sizeToWrite was calculated like this:
```
int sizeToWrite= sizeof (pdcp_data_ind_header_t) +
pdcpHead->data_size;
```
There were a few other similar invocations of write() in the same
function used the wrong size. That sizeToWrite calculation
should be used only when the header is being sent, too, which
happens in only one place in this function.
With this commit, our tests pass and -fsanitize=address is happy.
The global mbms_rab_id was defined as `uint16_t` in
eNB_scheduler_mch.c but `int` in other places. So, code that
wrotes this global would clobber the two bytes that follow the
variable in memory.
Found by `-fsanitize=address`.
In phy_free_lte_eNB in lte_init.c, the lte-uesoftmodem would
crash during shutdown because it was dereferencing null pointers.
This commit adds checks to avoid that.
Synchronized with emane.git's implementation of this code which
includes a unit test.
This commit also fixes two bugs in unqueue_matching and one inb
unqueue:
- unqueue_matching was returning the wrong pointer when
there was no match
- both unqueue_matching and unqueue were not clearing the vacated
queue entry after removing the item
This change is to enable use of gprof which requires the process
call `exit` to write out the collected data.
The UE (lte-uesoftmodem) exits cleanly, but the eNB
(lte-softmodem) crashes as it tries to shut down...
This change allows us to disable the LOG_I messages to reduce
overhead.
Removed LOG_VAR macro because it was used in only one place, and
a better solution is to simply use `__attribute__((unused))`.
Michael Cook