SRSENB: protect MAC softbuffers access

SRSENB: fix retransmissions

srsenb/src/stack/mac/mac.cc

@@ -576,6 +576,7 @@ int mac::get_dl_sched(uint32_t tti_tx_dl, dl_sched_list_t& dl_sched_res_list)
 
       // Copy data grants
       for (uint32_t i = 0; i < sched_result.nof_data_elems; i++) {
+        uint32_t tb_count = 0;
 
         // Get UE
         uint16_t rnti = sched_result.data[i].dci.rnti;
@@ -588,6 +589,11 @@ int mac::get_dl_sched(uint32_t tti_tx_dl, dl_sched_list_t& dl_sched_res_list)
             dl_sched_res->pdsch[n].softbuffer_tx[tb] =
                 ue_db[rnti]->get_tx_softbuffer(sched_result.data[i].dci.ue_cc_idx, sched_result.data[i].dci.pid, tb);
 
+            // If the Rx soft-buffer is not given, abort transmission
+            if (dl_sched_res->pdsch[n].softbuffer_tx[tb] == nullptr) {
+              continue;
+            }
+
             if (sched_result.data[i].nof_pdu_elems[tb] > 0) {
               /* Get PDU if it's a new transmission */
               dl_sched_res->pdsch[n].data[tb] = ue_db[rnti]->generate_pdu(sched_result.data[i].dci.ue_cc_idx,
@@ -605,13 +611,18 @@ int mac::get_dl_sched(uint32_t tti_tx_dl, dl_sched_list_t& dl_sched_res_list)
                 pcap->write_dl_crnti(
                     dl_sched_res->pdsch[n].data[tb], sched_result.data[i].tbs[tb], rnti, true, tti_tx_dl, enb_cc_idx);
               }
-
             } else {
               /* TB not enabled OR no data to send: set pointers to NULL  */
               dl_sched_res->pdsch[n].data[tb] = nullptr;
             }
+
+            tb_count++;
+          }
+
+          // Count transmission if at least one TB has succesfully added
+          if (tb_count > 0) {
+            n++;
           }
-          n++;
         } else {
           Warning("Invalid DL scheduling result. User 0x%x does not exist\n", rnti);
         }
@@ -868,6 +879,12 @@ int mac::get_ul_sched(uint32_t tti_tx_ul, ul_sched_list_t& ul_sched_res_list)
             phy_ul_sched_res->pusch[n].dci           = sched_result.pusch[i].dci;
             phy_ul_sched_res->pusch[n].softbuffer_rx =
                 ue_db[rnti]->get_rx_softbuffer(sched_result.pusch[i].dci.ue_cc_idx, tti_tx_ul);
+
+            // If the Rx soft-buffer is not given, abort reception
+            if (phy_ul_sched_res->pusch[n].softbuffer_rx == nullptr) {
+              continue;
+            }
+
             if (sched_result.pusch[n].current_tx_nb == 0) {
               srslte_softbuffer_rx_reset_tbs(phy_ul_sched_res->pusch[n].softbuffer_rx, sched_result.pusch[i].tbs * 8);
             }

srsenb/src/stack/mac/ue.cc

@@ -156,12 +156,32 @@ void ue::start_pcap(srslte::mac_pcap* pcap_)
 
 srslte_softbuffer_rx_t* ue::get_rx_softbuffer(const uint32_t ue_cc_idx, const uint32_t tti)
 {
+  if ((size_t)ue_cc_idx >= softbuffer_rx.size()) {
+    ERROR("UE CC Index (%d/%zd) out-of-range\n", ue_cc_idx, softbuffer_rx.size());
+    return nullptr;
+  }
+
+  if ((size_t)nof_rx_harq_proc > softbuffer_rx.at(ue_cc_idx).size()) {
+    ERROR("HARQ process index (%d/%zd) out-of-range\n", nof_rx_harq_proc, softbuffer_rx.at(ue_cc_idx).size());
+    return nullptr;
+  }
+
   return &softbuffer_rx.at(ue_cc_idx).at(tti % nof_rx_harq_proc);
 }
 
 srslte_softbuffer_tx_t*
 ue::get_tx_softbuffer(const uint32_t ue_cc_idx, const uint32_t harq_process, const uint32_t tb_idx)
 {
+  if ((size_t)ue_cc_idx >= softbuffer_tx.size()) {
+    ERROR("UE CC Index (%d/%zd) out-of-range\n", ue_cc_idx, softbuffer_tx.size());
+    return nullptr;
+  }
+
+  if ((size_t)nof_tx_harq_proc > softbuffer_tx.at(ue_cc_idx).size()) {
+    ERROR("HARQ process index (%d/%zd) out-of-range\n", harq_process, softbuffer_tx.at(ue_cc_idx).size());
+    return nullptr;
+  }
+
   return &softbuffer_tx.at(ue_cc_idx).at((harq_process * SRSLTE_MAX_TB + tb_idx) % nof_tx_harq_proc);
 }