From: scipio <scipio>
Date: Fri, 13 Apr 2007 17:31:15 +0000 (+0000)
Subject: Patch from John Regehr. Make queue catch it when the underlying radio
X-Git-Tag: tinyos/2.0.1~60
X-Git-Url: https://oss.titaniummirror.com/gitweb/?p=tinyos-2.x.git;a=commitdiff_plain;h=b77b7e339aec20be27c172d80ecad499520f83ec

Patch from John Regehr. Make queue catch it when the underlying radio
stack issues a spurious sendDone. Currently, if the queue is empty this
will cause it to access invalid memory (past the end of an array).

The real bug is the spurious sendDone, which he observed on the mica2.
However, until this bug is fixed, we need to catch it.
---

diff --git a/tos/system/AMQueueImplP.nc b/tos/system/AMQueueImplP.nc
index 8ea5c7aa..51cd2aec 100644
--- a/tos/system/AMQueueImplP.nc
+++ b/tos/system/AMQueueImplP.nc
@@ -179,13 +179,21 @@ implementation {
     }
   
     event void AMSend.sendDone[am_id_t id](message_t* msg, error_t err) {
-        if(queue[current].msg == msg) {
-            sendDone(current, msg, err);
-        }
-        else {
-            dbg("PointerBug", "%s received send done for %p, signaling for %p.\n",
-                __FUNCTION__, msg, queue[current].msg);
-        }
+      // Bug fix from John Regehr: if the underlying radio mixes things
+      // up, we don't want to read memory incorrectly. This can occur
+      // on the mica2.
+      // Note that since all AM packets go through this queue, this
+      // means that the radio has a problem. -pal
+      if (current >= numClients) {
+	return;
+      }
+      if(queue[current].msg == msg) {
+	sendDone(current, msg, err);
+      }
+      else {
+	dbg("PointerBug", "%s received send done for %p, signaling for %p.\n",
+	    __FUNCTION__, msg, queue[current].msg);
+      }
     }
     
     command uint8_t Send.maxPayloadLength[uint8_t id]() {