mirror of https://github.com/PentHertz/srsLTE.git
Add check for rx_window tailroom
This commit is contained in:
parent
9d6c323001
commit
2a4a84a578
|
@ -1166,6 +1166,7 @@ void rlc_am::handle_control_pdu(uint8_t *payload, uint32_t nof_bytes)
|
||||||
|
|
||||||
void rlc_am::reassemble_rx_sdus()
|
void rlc_am::reassemble_rx_sdus()
|
||||||
{
|
{
|
||||||
|
uint32_t len = 0;
|
||||||
if(!rx_sdu) {
|
if(!rx_sdu) {
|
||||||
rx_sdu = pool_allocate;
|
rx_sdu = pool_allocate;
|
||||||
if (!rx_sdu) {
|
if (!rx_sdu) {
|
||||||
|
@ -1185,41 +1186,46 @@ void rlc_am::reassemble_rx_sdus()
|
||||||
// Handle any SDU segments
|
// Handle any SDU segments
|
||||||
for(uint32_t i=0; i<rx_window[vr_r].header.N_li; i++)
|
for(uint32_t i=0; i<rx_window[vr_r].header.N_li; i++)
|
||||||
{
|
{
|
||||||
uint32_t len = rx_window[vr_r].header.li[i];
|
len = rx_window[vr_r].header.li[i];
|
||||||
// sanity check to avoid zero-size SDUs
|
// sanity check to avoid zero-size SDUs
|
||||||
if (len == 0) {
|
if (len == 0) {
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (rx_sdu->get_tailroom() >= len) {
|
if (rx_sdu->get_tailroom() >= len) {
|
||||||
memcpy(&rx_sdu->msg[rx_sdu->N_bytes], rx_window[vr_r].buf->msg, len);
|
if (rx_window[vr_r].buf->get_tailroom() >= len) {
|
||||||
rx_sdu->N_bytes += len;
|
memcpy(&rx_sdu->msg[rx_sdu->N_bytes], rx_window[vr_r].buf->msg, len);
|
||||||
rx_window[vr_r].buf->msg += len;
|
rx_sdu->N_bytes += len;
|
||||||
rx_window[vr_r].buf->N_bytes -= len;
|
rx_window[vr_r].buf->msg += len;
|
||||||
log->info_hex(rx_sdu->msg, rx_sdu->N_bytes, "%s Rx SDU (%d B)", rrc->get_rb_name(lcid).c_str(), rx_sdu->N_bytes);
|
rx_window[vr_r].buf->N_bytes -= len;
|
||||||
rx_sdu->set_timestamp();
|
log->info_hex(rx_sdu->msg, rx_sdu->N_bytes, "%s Rx SDU (%d B)", rrc->get_rb_name(lcid).c_str(), rx_sdu->N_bytes);
|
||||||
pdcp->write_pdu(lcid, rx_sdu);
|
rx_sdu->set_timestamp();
|
||||||
|
pdcp->write_pdu(lcid, rx_sdu);
|
||||||
|
|
||||||
rx_sdu = pool_allocate;
|
rx_sdu = pool_allocate;
|
||||||
if (!rx_sdu) {
|
if (!rx_sdu) {
|
||||||
#ifdef RLC_AM_BUFFER_DEBUG
|
#ifdef RLC_AM_BUFFER_DEBUG
|
||||||
log->console("Fatal Error: Could not allocate PDU in reassemble_rx_sdus() (2)\n");
|
log->console("Fatal Error: Could not allocate PDU in reassemble_rx_sdus() (2)\n");
|
||||||
exit(-1);
|
exit(-1);
|
||||||
#else
|
#else
|
||||||
log->error("Fatal Error: Could not allocate PDU in reassemble_rx_sdus() (2)\n");
|
log->error("Fatal Error: Could not allocate PDU in reassemble_rx_sdus() (2)\n");
|
||||||
return;
|
return;
|
||||||
#endif
|
#endif
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
log->error("Cannot read %d bytes from rx_window. vr_r=%d, tailroom=%d bytes\n", len, rx_window[vr_r].buf->get_tailroom());
|
||||||
|
pool->deallocate(rx_sdu);
|
||||||
|
goto exit;
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
log->error("Cannot fit RLC PDU in SDU buffer, dropping both.\n");
|
log->error("Cannot fit RLC PDU in SDU buffer, dropping both.\n");
|
||||||
pool->deallocate(rx_sdu);
|
pool->deallocate(rx_sdu);
|
||||||
pool->deallocate(rx_window[vr_r].buf);
|
goto exit;
|
||||||
rx_window.erase(vr_r);
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Handle last segment
|
// Handle last segment
|
||||||
uint32_t len = rx_window[vr_r].buf->N_bytes;
|
len = rx_window[vr_r].buf->N_bytes;
|
||||||
if (rx_sdu->get_tailroom() >= len) {
|
if (rx_sdu->get_tailroom() >= len) {
|
||||||
memcpy(&rx_sdu->msg[rx_sdu->N_bytes], rx_window[vr_r].buf->msg, len);
|
memcpy(&rx_sdu->msg[rx_sdu->N_bytes], rx_window[vr_r].buf->msg, len);
|
||||||
rx_sdu->N_bytes += rx_window[vr_r].buf->N_bytes;
|
rx_sdu->N_bytes += rx_window[vr_r].buf->N_bytes;
|
||||||
|
@ -1246,6 +1252,7 @@ void rlc_am::reassemble_rx_sdus()
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
exit:
|
||||||
// Move the rx_window
|
// Move the rx_window
|
||||||
pool->deallocate(rx_window[vr_r].buf);
|
pool->deallocate(rx_window[vr_r].buf);
|
||||||
rx_window.erase(vr_r);
|
rx_window.erase(vr_r);
|
||||||
|
|
Loading…
Reference in New Issue