mirror of
				https://gitea.osmocom.org/cellular-infrastructure/osmo-trx.git
				synced 2025-11-03 21:53:18 +00:00 
			
		
		
		
	Transceiver: Fix race condition obtaining Dl burst from Upper layer
The queue was being accessed sequentially obtaining and releasing the mutual exclusion zone twice. First in getStaleBurst() dropping all FN<currTime, then in getCurrentBurst() trying to obtain FN=currTime. However, since in between the mutex is released, it could happen that for instance upper layer would introduce currTime-1 in the queue, which would make then getCurrentBurst() detect that one instead of potential currTime in the queue and return NULL. By holding the mutex during the call to both functions we make sure the state is kept during the whole transaction. Related: OS#4487 (comment #7) Change-Id: If1fd8d7fc5f21ee2894192ef1ac2a3cdda6bbb98
This commit is contained in:
		@@ -433,9 +433,15 @@ void Transceiver::pushRadioVector(GSM::Time &nowTime)
 | 
			
		||||
  std::vector<bool> filler(mChans, true);
 | 
			
		||||
  bool stale_bursts_changed;
 | 
			
		||||
 | 
			
		||||
  TN = nowTime.TN();
 | 
			
		||||
 | 
			
		||||
  for (size_t i = 0; i < mChans; i ++) {
 | 
			
		||||
    state = &mStates[i];
 | 
			
		||||
    stale_bursts_changed = false;
 | 
			
		||||
    zeros[i] = state->chanType[TN] == NONE;
 | 
			
		||||
 | 
			
		||||
    Mutex *mtx = mTxPriorityQueues[i].getMutex();
 | 
			
		||||
    mtx->lock();
 | 
			
		||||
 | 
			
		||||
    while ((burst = mTxPriorityQueues[i].getStaleBurst(nowTime))) {
 | 
			
		||||
      LOGCHAN(i, DTRXDDL, NOTICE) << "dumping STALE burst in TRX->SDR interface ("
 | 
			
		||||
@@ -447,15 +453,6 @@ void Transceiver::pushRadioVector(GSM::Time &nowTime)
 | 
			
		||||
      delete burst;
 | 
			
		||||
    }
 | 
			
		||||
 | 
			
		||||
    if (stale_bursts_changed)
 | 
			
		||||
      dispatch_trx_rate_ctr_change(state, i);
 | 
			
		||||
 | 
			
		||||
    TN = nowTime.TN();
 | 
			
		||||
    modFN = nowTime.FN() % state->fillerModulus[TN];
 | 
			
		||||
 | 
			
		||||
    bursts[i] = state->fillerTable[modFN][TN];
 | 
			
		||||
    zeros[i] = state->chanType[TN] == NONE;
 | 
			
		||||
 | 
			
		||||
    if ((burst = mTxPriorityQueues[i].getCurrentBurst(nowTime))) {
 | 
			
		||||
      bursts[i] = burst->getVector();
 | 
			
		||||
 | 
			
		||||
@@ -467,7 +464,15 @@ void Transceiver::pushRadioVector(GSM::Time &nowTime)
 | 
			
		||||
      }
 | 
			
		||||
 | 
			
		||||
      delete burst;
 | 
			
		||||
    } else {
 | 
			
		||||
      modFN = nowTime.FN() % state->fillerModulus[TN];
 | 
			
		||||
      bursts[i] = state->fillerTable[modFN][TN];
 | 
			
		||||
    }
 | 
			
		||||
 | 
			
		||||
    mtx->unlock();
 | 
			
		||||
 | 
			
		||||
    if (stale_bursts_changed)
 | 
			
		||||
      dispatch_trx_rate_ctr_change(state, i);
 | 
			
		||||
  }
 | 
			
		||||
 | 
			
		||||
  mRadioInterface->driveTransmitRadio(bursts, zeros);
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user