Hi,

the issue occurs in this code (radio/USRP/usrp_lib.cpp of OAI), in the red-marked line (line 757):

 samples_received=0;
while(samples_received != nsamps) {

if(cc>1) {
// receive multiple channels (e.g. RF A and RF B)
     std::vector<void*> buff_ptrs;

for(inti=0; i<cc; i++) buff_ptrs.push_back(buff_tmp[i]+samples_received);
*samples_received += s->rx_stream->recv(buff_ptrs, nsamps, s->rx_md); *
}else{
// receive a single channel (e.g. from connector RF A)

     samples_received += s->rx_stream->recv((void*)((int32_t*)buff_tmp[0]+samples_received),                                             nsamps-samples_received, s->rx_md);
}
if ((s->wait_for_first_pps == 0) && (s->rx_md.error_code!=uhd::rx_metadata_t::ERROR_CODE_NONE))
break;

if((s->wait_for_first_pps == 1) && (samples_received != nsamps)) {
     printf("sleep...\n"); //usleep(100);
}
}

Reading the code, it seems to be for reading N channels and reading 1 channel. For reading 1 channel, the length given to s->rx_stream->recv is nsamps-samples_received. However, for reading N channels, the length is always nsamps. Since the buffer may have already been incremented by samples_received > 0, this leads to overwriting the stack. So, this is very likely a bug in libuhd.

Changing the code by:

      for (int i=0; i<cc; i++) buff_ptrs.push_back(buff_tmp[i]+samples_received);
-      samples_received += s->rx_stream->recv(buff_ptrs, nsamps, s->rx_md);
+      samples_received += s->rx_stream->recv(buff_ptrs, nsamps-samples_received, s->rx_md);
    } else {

lets nr-softmodem proceed without segfault. But then, it prints a lot of these lines:

[PHY]   rx_rf: Asked for 30720 samples, got 20941 from USRP
[PHY]   problem receiving samples
LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLO[HW]   [recv] received 20941 samples out of 30720
[HW]   Time: 4.35875 s
ERROR_CODE_OVERFLOW (Overflow)

[PHY]   rx_rf: Asked for 30720 samples, got 20941 from USRP
[PHY]   problem receiving samples
LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLO[HW]   [recv] received 20941 samples out of 30720
[HW]   Time: 4.41057 s
ERROR_CODE_OVERFLOW (Overflow)
...


On 9/13/23 10:55, Thomas Dreibholz wrote:
I am trying to get OAI's nr-softmodem to run with an Ettus URSP N310, using targets/PROJECTS/GENERIC-NR-5GC/CONF/gnb.band78.sa.fr1.106PRB.2x2.usrpn310.conf with just having adapted the IP addresses of the core and device. Regardless of trying with UHD 4.1 to 4.4, and regardless of the tags for OAI used (latest tried: 2023.w36), running nr-softmodem reproducibly segfaults after a few seconds in libuhd:

--
Best regards / Mit freundlichen Grüßen / Med vennlig hilsen

=======================================================================
 Thomas Dreibholz

 SimulaMet — Simula Metropolitan Centre for Digital Engineering
 Centre for Resilient Networks and Applications
 Pilestredet 52
 0167 Oslo, Norway
-----------------------------------------------------------------------
 E-Mail:dre...@simula.no
 Homepage:http://simula.no/people/dreibh
=======================================================================

Attachment: OpenPGP_signature
Description: OpenPGP digital signature

_______________________________________________
USRP-users mailing list -- usrp-users@lists.ettus.com
To unsubscribe send an email to usrp-users-le...@lists.ettus.com

Reply via email to