Transceiver: Fix race condition obtaining Dl burst from Upper layer

The queue was being accessed sequentially obtaining and releasing the
mutual exclusion zone twice. First in getStaleBurst() dropping all
FN<currTime, then in getCurrentBurst() trying to obtain FN=currTime.

However, since in between the mutex is released, it could happen that
for instance upper layer would introduce currTime-1 in the queue, which
would make then getCurrentBurst() detect that one instead of potential
currTime in the queue and return NULL.

By holding the mutex during the call to both functions we make sure the
state is kept during the whole transaction.

Related: OS#4487 (comment #7)
Change-Id: If1fd8d7fc5f21ee2894192ef1ac2a3cdda6bbb98

Transceiver52M/Transceiver.cpp

@@ -433,9 +433,15 @@ void Transceiver::pushRadioVector(GSM::Time &nowTime)
   std::vector<bool> filler(mChans, true);
   bool stale_bursts_changed;
 
+  TN = nowTime.TN();
+
   for (size_t i = 0; i < mChans; i ++) {
     state = &mStates[i];
     stale_bursts_changed = false;
+    zeros[i] = state->chanType[TN] == NONE;
+
+    Mutex *mtx = mTxPriorityQueues[i].getMutex();
+    mtx->lock();
 
     while ((burst = mTxPriorityQueues[i].getStaleBurst(nowTime))) {
       LOGCHAN(i, DTRXDDL, NOTICE) << "dumping STALE burst in TRX->SDR interface ("
@@ -447,15 +453,6 @@ void Transceiver::pushRadioVector(GSM::Time &nowTime)
       delete burst;
     }
 
-    if (stale_bursts_changed)
-      dispatch_trx_rate_ctr_change(state, i);
-
-    TN = nowTime.TN();
-    modFN = nowTime.FN() % state->fillerModulus[TN];
-
-    bursts[i] = state->fillerTable[modFN][TN];
-    zeros[i] = state->chanType[TN] == NONE;
-
     if ((burst = mTxPriorityQueues[i].getCurrentBurst(nowTime))) {
       bursts[i] = burst->getVector();
 
@@ -467,7 +464,15 @@ void Transceiver::pushRadioVector(GSM::Time &nowTime)
       }
 
       delete burst;
+    } else {
+      modFN = nowTime.FN() % state->fillerModulus[TN];
+      bursts[i] = state->fillerTable[modFN][TN];
     }
+
+    mtx->unlock();
+
+    if (stale_bursts_changed)
+      dispatch_trx_rate_ctr_change(state, i);
   }
 
   mRadioInterface->driveTransmitRadio(bursts, zeros);

Transceiver52M/radioVector.cpp

@@ -120,38 +120,26 @@ GSM::Time VectorQueue::nextTime() const
 
 radioVector* VectorQueue::getStaleBurst(const GSM::Time& targTime)
 {
-	mLock.lock();
+	if ((mQ.size()==0))
-	if ((mQ.size()==0)) {
-		mLock.unlock();
 		return NULL;
-	}
 
 	if (mQ.top()->getTime() < targTime) {
 		radioVector* retVal = mQ.top();
 		mQ.pop();
-		mLock.unlock();
 		return retVal;
 	}
-	mLock.unlock();
-
 	return NULL;
 }
 
 radioVector* VectorQueue::getCurrentBurst(const GSM::Time& targTime)
 {
-	mLock.lock();
+	if ((mQ.size()==0))
-	if ((mQ.size()==0)) {
-		mLock.unlock();
 		return NULL;
-	}
 
 	if (mQ.top()->getTime() == targTime) {
 		radioVector* retVal = mQ.top();
 		mQ.pop();
-		mLock.unlock();
 		return retVal;
 	}
-	mLock.unlock();
-
 	return NULL;
 }

Transceiver52M/radioVector.h

@@ -65,6 +65,7 @@ public:
 	GSM::Time nextTime() const;
 	radioVector* getStaleBurst(const GSM::Time& targTime);
 	radioVector* getCurrentBurst(const GSM::Time& targTime);
+	Mutex *getMutex() const { return &mLock; };
 };
 
 #endif /* RADIOVECTOR_H */