- fix reestablishment reject transmission in the srsenb. For SRB0 SDUs, no RLC header is required, so we do not need to check in such case if there is enough space in the TB for the header.

- fix srsenb reestablishment check for UE context. The pci has to be accounted for the srsenb to understand that the UE trying to do reestablishment corresponds to one of its own

srsenb/src/stack/mac/ue.cc

@@ -401,11 +401,12 @@ int ue::read_pdu(uint32_t lcid, uint8_t* payload, uint32_t requested_bytes)
 
 void ue::allocate_sdu(srslte::sch_pdu* pdu, uint32_t lcid, uint32_t total_sdu_len)
 {
+  const int min_sdu_len = lcid == 0 ? 1 : 2;
   int       sdu_space   = pdu->get_sdu_space();
   if (sdu_space > 0) {
     int sdu_len = SRSLTE_MIN(total_sdu_len, (uint32_t)sdu_space);
     int n       = 1;
-    while (sdu_len >= 2 && n > 0) { // minimum size is a single RLC AM status PDU (2 Byte)
+    while (sdu_len >= min_sdu_len && n > 0) { // minimum size is a single RLC AM status PDU (2 Byte)
       if (pdu->new_subh()) {                  // there is space for a new subheader
         log_h->debug("SDU:   set_sdu(), lcid=%d, sdu_len=%d, sdu_space=%d\n", lcid, sdu_len, sdu_space);
         n = pdu->get()->set_sdu(lcid, sdu_len, this);

srsenb/src/stack/rrc/rrc_ue.cc

@@ -332,7 +332,12 @@ void rrc::ue::handle_rrc_con_reest_req(rrc_conn_reest_request_s* msg)
                          msg->crit_exts.rrc_conn_reest_request_r8().reest_cause.to_string().c_str());
   if (is_idle()) {
     uint16_t                old_rnti = msg->crit_exts.rrc_conn_reest_request_r8().ue_id.c_rnti.to_number();
-    if (parent->users.count(old_rnti)) {
+    uint16_t                old_pci  = msg->crit_exts.rrc_conn_reest_request_r8().ue_id.pci;
+    const cell_info_common* old_cell = parent->cell_common_list->get_pci(old_pci);
+    auto                    ue_it    = parent->users.find(old_rnti);
+    // Reject unrecognized rntis, and PCIs that do not belong to eNB
+    if (ue_it != parent->users.end() and old_cell != nullptr and
+        ue_it->second->cell_ded_list.get_enb_cc_idx(old_cell->enb_cc_idx) != nullptr) {
       parent->rrc_log->info("ConnectionReestablishmentRequest for rnti=0x%x. Sending Connection Reestablishment\n",
                             old_rnti);
       send_connection_reest(parent->users[old_rnti]->ue_security_cfg.get_ncc());