Commit 21a2a8c6 authored by Cedric Roux's avatar Cedric Roux

rlc v2: some fixes for 'bugs' found by coverity scan

Minor fixes, doesn't change anything. Not sure these are 'bugs' either,
but let's be polite with coverity scan...

One thing was not changed.
Coverity scan says:
*** CID 357991:  Memory - illegal accesses  (USE_AFTER_FREE)
/home/carabe/raphael/openairinterface5g/openair2/LAYER2/rlc_v2/rlc_entity_am.c: 507 in tx_list_remove_sn()
501         } else {
502           prev = cur;
503           cur = cur->next;
504         }
505       }
506
>>>     CID 357991:  Memory - illegal accesses  (USE_AFTER_FREE)
>>>     Using freed pointer "head.next".
507       return head.next;
508     }
509
510     void cleanup_sdu_list(rlc_entity_am_t *entity)
511     {
512       rlc_sdu_t head;

But as far as I understand, there is no problem. We don't access
head.next at all if it has been freed. Or is there some aliasing
going on there (pointer aliasing)? I doubt it. False positive?
parent cd82d94c
develop 1 128-ues 256_QAM_demod NCTU_OpinConnect_LDPC NR-PHY-MAC-IF-multi-UE NR_10MHz NR_CSI_reporting NR_DCI_01 NR_DL_sched_fixes NR_DL_scheduler NR_FAPI_beamindex_SSB_RO NR_FR2_RA NR_FR2_RRC_SSB NR_MAC_CE_GlobalEdge NR_MAC_Multi_Rach_GlobalEdge NR_MAC_SSB_RO_GlobalEdge NR_MAC_SSB_RO_UE_IDCC NR_MAC_SSB_RO_merge NR_MAC_TCI_UCI_GlobalEdge NR_NGAP NR_PUCCH_MultiUE NR_RA_updates NR_RRCConfiguration_FR2 NR_RRC_PDCP NR_RRC_X2AP_AMBR_Change_Global_edge NR_RRC_X2AP_RemoveHardcodings_GlobalEdge NR_RRC_config_simplified NR_SA_NGAP_RRC NR_SA_NGAP_RRC_wk42 NR_SA_itti_sim_wk48 NR_SRB_Config NR_UE_MAC_scheduler NR_UE_RA_fixes NR_UE_UL_DCI_improvements NR_UE_enable_parallelization NR_UE_stability_fixes NR_UL_FAPI_programming NR_UL_scheduler NR_UL_scheduler_rebased NR_UL_scheduling NR_ipaccess_testing NR_mac_uci_functions_rework NR_msg2_phytest NR_scheduling_CSIRS NR_scheduling_request NR_ue_dlsch_dmrs_cdm PUSCH_TA_update RA_CI_test UE_DL_DCI_hotfix bch-fixes-bitmap benetel_5g_prach_fix benetel_phase_rotation benetel_phase_rotation_old bugfix-minor-remove-wrong-log bugfix-nr-bands bugfix-nr-ldpc-post-processing bugfix-nr-ldpc-size-typo bugfix-nr-pdcp-sn-size bugfix-nr-rate-matching-assertion cce_indexing_fix cce_indexing_fix2 ci-deploy-docker-compose ci-rd-july-improvements ci-ul-iperf-from-trf-container clean-5G-scope-round2 cleanup_softmodem_main constant_power develop-oriecpriupdates develop-sib1 develop_inria_ci_deployment dfts_alternatives dlsch-all-dlslots dlsch_encode_mthread dlsch_parallel dongzhanyi-zte-develop dongzhanyi-zte-develop2 feature/make-s1-mme-port-configurable feature/make-s1-mme-port-configurable-with-astyle-fixes fembms-enb-ue finalize-oaicn-integration firas fix-ci-tun fix-itti-segv fix-softmodem-restart fix_do_ra_data fix_pdsch_low_prb fix_rfsim_mimo fix_rrc_x2_ticking fixes-mac-sched-nfapi fixes-mac-sched-tun fixes-tun flexran-apps flexran-repair-mme-mgmt fujitsu_lte_contribution fujitsu_lte_contribution-128 harq-hotfix hotfix-minor-remove-nr-rlc-cppcheck-error hotfix-nr-rlc-tick hotfix-ocp-executable improve_nr_modulation improve_ue_stability integration_2020_wk40 integration_2020_wk41 integration_2020_wk42_2 integration_2020_wk45 integration_2020_wk45_2 integration_2020_wk46 integration_2020_wk46_2 integration_2020_wk47 integration_2020_wk48 integration_2020_wk48_2 integration_2020_wk49 integration_2020_wk50 integration_2020_wk50_1 inter-RRU-final inter-RRU-oairu inter-rru-UE ldpc-decoder-codegen ldpc-decoder-codegen2 ldpc-offload ldpc_short_codeword_fixes load_gnb lte_uplink_improvement mac-fixes-wk45_2 mosaic5g-oai-ran mosaic5g-oai-sim nfapi-bugfix nfapi_nr_develop ngap-dlul ngap-support ngap-w48-merge2 ngap-wf ngap-wf-1120 ngap-wf-1120-srb ngap-wf-1120-srb-gtp ngap-wf-1120-srb-gtp-hs ngap-wf-1120-srb-gtp-hs1 ngap-wf-1120-srb-gtp-hs2 ngap-wf-1203-yunsdr ngap-wf-liuyu ngap_lfq_1120 ngap_merge noCore nr-mac-pdu-wireshark nr-mac-remove-ue-list nr-rlc-am-bugfix-w44 nr-rlc-bugfix-w44 nrUE nrUE-hs nrUE-upper-layer nr_bsr nr_dl_dmrs_type2 nr_dl_pf nr_dl_pf2 nr_dl_ul_ptrs nr_fdd_if_fix nr_polar_decoder_improvement nr_prach_fr2 nr_ue_msg3 nr_ue_tti_cleanup nrue_msg2_reception nsa-ue nsa_remove_band_hardcodings oai-sim oairu oc-docker-october-improvements openxg/develop pdcp-benchmark polar8 ptrs_rrc_config pusch-mthread-scaling-fix ra-dl-ul remove_nos1_hack_pdcp remove_x2_gnb_hardcoding repair-TA revert_memcpy rh_ci_fix_autoterminate rh_ci_fr1_update rh_ci_oc rh_ci_py rh_ci_rfsim_ra rh_doc_update_3 rh_fr1_newjenkins rh_fr1_update rh_gnb_compile_fix rh_wk50_debug rlc-v2-bugfix-status-reporting rlc-v2-tick rlc_v2_coverity_fixes rrc-enb-phy-testmode s1_subnormal s1ap-bugfix-rab_setup small-bugfixes-w40 smallcleanup testing_2symb_pdcch testing_with_external_txdata tp-ota-test trx_thread_param ue-csi ue-fixes-ota ul_dl_dci_same_slot ul_harq ulsch_decode_mthread ulsim_changes x2-endc-processing yihongzheng_srb zzs
No related merge requests found
......@@ -360,6 +360,7 @@ static tx_pdu_size_t tx_pdu_size(rlc_entity_um_t *entity, int maxsize)
ret.data_size = 0;
ret.header_size = 0;
ret.last_sdu_is_full = 1;
ret.first_sdu_length = 0;
/* TX PDU - let's make the biggest PDU we can with the SDUs we have */
sdu_count = 0;
......
......@@ -134,7 +134,10 @@ tbs_size_t mac_rlc_data_req(
}
if (MBMS_flagP == MBMS_FLAG_YES) {
rb = ue->drb[channel_idP - 1];
if (channel_idP >= 1 && channel_idP <= 5)
rb = ue->drb[channel_idP - 1];
else
rb = NULL;
}
......@@ -192,7 +195,10 @@ mac_rlc_status_resp_t mac_rlc_status_ind(
}
if (MBMS_flagP == MBMS_FLAG_YES) {
rb = ue->drb[channel_idP - 1];
if (channel_idP >= 1 && channel_idP <= 5)
rb = ue->drb[channel_idP - 1];
else
rb = NULL;
}
if (rb != NULL) {
......@@ -316,7 +322,9 @@ rlc_op_status_t rlc_data_req (const protocol_ctxt_t *const ctxt_pP,
if (rb_idP >= 1 && rb_idP <= 5)
rb = ue->drb[rb_idP - 1];
}
if( MBMS_flagP == MBMS_FLAG_YES) {
if (rb_idP >= 1 && rb_idP <= 5)
rb = ue->drb[rb_idP - 1];
}
......@@ -875,12 +883,19 @@ rlc_op_status_t rrc_rlc_config_asn1_req (const protocol_ctxt_t * const ctxt_pP
mbms_service_id = MBMS_SessionInfo_p->tmgi_r9.serviceId_r9.buf[2]; //serviceId is 3-octet string
// mbms_service_id = j;
#if 0
/* TODO: check if this code should stay there
* as it is both enb and ue cases do the same thing
*/
// can set the mch_id = i
if (ctxt_pP->enb_flag) {
drb_id = (mbms_service_id * LTE_maxSessionPerPMCH ) + mbms_session_id;//+ (LTE_maxDRB + 3) * MAX_MOBILES_PER_ENB; // 1
} else {
drb_id = (mbms_service_id * LTE_maxSessionPerPMCH ) + mbms_session_id; // + (LTE_maxDRB + 3); // 15
}
#endif
drb_id = (mbms_service_id * LTE_maxSessionPerPMCH ) + mbms_session_id;
LOG_I(RLC, PROTOCOL_CTXT_FMT" CONFIG REQ MBMS ASN1 LC ID %u RB ID %u SESSION ID %u SERVICE ID %u, mbms_rnti %x\n",
PROTOCOL_CTXT_ARGS(ctxt_pP),
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment