lib,rlc_am_{lte,nr}: fix/add tx_window overrun protection

This commit fixes as bug causing a crash of the eNB in case
of many pending RETX and the reception of a trimmed PDU.
The following sequence leads to a crash:
- RETX queue contains many PDUs for RETX
- Receive trimmed PDU containing a trimmed subset of NACKs
- RETX queue is cleared and re-populated with a trimmed subset
- After all RETX (/!\ trimmed subset) is done, continue TX new PDUs
- tx_window blows up
- tx_window overflows if another status PDU is not received in time
- Overflow overwrites oldest element in tx_window
- Handling of next status PDU fails due to missing elements in tx_window

Related PR #4029
This commit is contained in:
Robert Falkenberg 2022-05-23 12:15:25 +02:00
parent 66b5b6c236
commit fccfd5e140
2 changed files with 9 additions and 2 deletions

View File

@ -690,8 +690,8 @@ int rlc_am_lte_tx::build_data_pdu(uint8_t* payload, uint32_t nof_bytes)
}
// do not build any more PDU if window is already full
if (tx_sdu == NULL && tx_window.size() >= RLC_AM_WINDOW_SIZE) {
RlcInfo("Tx window full.");
if (tx_window.size() >= RLC_AM_WINDOW_SIZE) {
RlcInfo("Cannot build data PDU - Tx window full.");
return 0;
}

View File

@ -175,6 +175,13 @@ uint32_t rlc_am_nr_tx::build_new_pdu(uint8_t* payload, uint32_t nof_bytes)
RlcInfo("Not enough bytes for payload plus header. nof_bytes=%d", nof_bytes);
return 0;
}
// do not build any more PDU if window is already full
if (tx_window->size() >= RLC_AM_WINDOW_SIZE) {
RlcInfo("Cannot build data PDU - Tx window full.");
return 0;
}
// Read new SDU from TX queue
unique_byte_buffer_t tx_sdu;
RlcDebug("Reading from RLC SDU queue. Queue size %d", tx_sdu_queue.size());