From 15a376fab2f1ff63bece8c2dd3b2343a0c14c3aa Mon Sep 17 00:00:00 2001 From: Thomas Schlichter Date: Thu, 3 Sep 2020 09:10:51 +0200 Subject: [PATCH] Harden nr_get_Qm() and nr_get_code_rate_dl() functions Check the provided MCS index according to the specified table. Some tables go up to MCS index 27, others up to MCS index 28. If the MCS index exceeds the allowed limit, assume max. MCS. --- openair2/LAYER2/NR_MAC_COMMON/nr_mac_common.c | 72 +++++++++++++++++-- openair2/LAYER2/NR_MAC_UE/nr_ue_procedures.c | 3 +- 2 files changed, 70 insertions(+), 5 deletions(-) diff --git a/openair2/LAYER2/NR_MAC_COMMON/nr_mac_common.c b/openair2/LAYER2/NR_MAC_COMMON/nr_mac_common.c index f40d822b6b..ef31357a1f 100644 --- a/openair2/LAYER2/NR_MAC_COMMON/nr_mac_common.c +++ b/openair2/LAYER2/NR_MAC_COMMON/nr_mac_common.c @@ -1615,92 +1615,156 @@ uint16_t Table_61412[28][2] = {{2,30},{2,40},{2,50},{2,64},{2,78},{2,99},{2,120} uint8_t nr_get_Qm_dl(uint8_t Imcs, uint8_t table_idx) { switch(table_idx) { case 0: + if (Imcs > 28) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 0 (expected range [0,28])\n", Imcs); + Imcs = 28; + } return (Table_51311[Imcs][0]); break; case 1: + if (Imcs > 27) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 1 (expected range [0,27])\n", Imcs); + Imcs = 27; + } return (Table_51312[Imcs][0]); break; case 2: + if (Imcs > 28) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 2 (expected range [0,28])\n", Imcs); + Imcs = 28; + } return (Table_51313[Imcs][0]); break; default: - AssertFatal(0, "Invalid MCS table index %d (expected in range [1,3])\n", table_idx); + AssertFatal(0, "Invalid MCS table index %d (expected in range [0,2])\n", table_idx); } } uint32_t nr_get_code_rate_dl(uint8_t Imcs, uint8_t table_idx) { switch(table_idx) { case 0: + if (Imcs > 28) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 0 (expected range [0,28])\n", Imcs); + Imcs = 28; + } return (Table_51311[Imcs][1]); break; case 1: + if (Imcs > 27) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 1 (expected range [0,27])\n", Imcs); + Imcs = 27; + } return (Table_51312[Imcs][1]); break; case 2: + if (Imcs > 28) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 2 (expected range [0,28])\n", Imcs); + Imcs = 28; + } return (Table_51313[Imcs][1]); break; default: - AssertFatal(0, "Invalid MCS table index %d (expected in range [1,3])\n", table_idx); + AssertFatal(0, "Invalid MCS table index %d (expected in range [0,2])\n", table_idx); } } uint8_t nr_get_Qm_ul(uint8_t Imcs, uint8_t table_idx) { switch(table_idx) { case 0: + if (Imcs > 28) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 0 (expected range [0,28])\n", Imcs); + Imcs = 28; + } return (Table_51311[Imcs][0]); break; case 1: + if (Imcs > 27) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 1 (expected range [0,27])\n", Imcs); + Imcs = 27; + } return (Table_51312[Imcs][0]); break; case 2: + if (Imcs > 28) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 2 (expected range [0,28])\n", Imcs); + Imcs = 28; + } return (Table_51313[Imcs][0]); break; case 3: + if (Imcs > 27) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 3 (expected range [0,27])\n", Imcs); + Imcs = 27; + } return (Table_61411[Imcs][0]); break; case 4: + if (Imcs > 27) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 4 (expected range [0,27])\n", Imcs); + Imcs = 27; + } return (Table_61412[Imcs][0]); break; default: - AssertFatal(0, "Invalid MCS table index %d (expected in range [1,2])\n", table_idx); + AssertFatal(0, "Invalid MCS table index %d (expected in range [0,4])\n", table_idx); } } uint32_t nr_get_code_rate_ul(uint8_t Imcs, uint8_t table_idx) { switch(table_idx) { case 0: + if (Imcs > 28) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 0 (expected range [0,28])\n", Imcs); + Imcs = 28; + } return (Table_51311[Imcs][1]); break; case 1: + if (Imcs > 27) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 1 (expected range [0,27])\n", Imcs); + Imcs = 27; + } return (Table_51312[Imcs][1]); break; case 2: + if (Imcs > 28) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 2 (expected range [0,28])\n", Imcs); + Imcs = 28; + } return (Table_51313[Imcs][1]); break; case 3: + if (Imcs > 27) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 3 (expected range [0,27])\n", Imcs); + Imcs = 27; + } return (Table_61411[Imcs][1]); break; case 4: + if (Imcs > 27) { + LOG_E(MAC, "Invalid MCS index %d for MCS table 4 (expected range [0,27])\n", Imcs); + Imcs = 27; + } return (Table_61412[Imcs][1]); break; default: - AssertFatal(0, "Invalid MCS table index %d (expected in range [1,2])\n", table_idx); + AssertFatal(0, "Invalid MCS table index %d (expected in range [0,4])\n", table_idx); } } diff --git a/openair2/LAYER2/NR_MAC_UE/nr_ue_procedures.c b/openair2/LAYER2/NR_MAC_UE/nr_ue_procedures.c index c4ee06cd2f..8f83ef8676 100644 --- a/openair2/LAYER2/NR_MAC_UE/nr_ue_procedures.c +++ b/openair2/LAYER2/NR_MAC_UE/nr_ue_procedures.c @@ -3802,7 +3802,8 @@ void nr_ue_process_mac_pdu(module_id_t module_idP, } pdu_ptr += ( mac_subheader_len + mac_ce_len + mac_sdu_len ); pdu_len -= ( mac_subheader_len + mac_ce_len + mac_sdu_len ); - AssertFatal(pdu_len >= 0, "[MAC] nr_ue_process_mac_pdu, residual mac pdu length < 0!\n"); + if (pdu_len < 0) + LOG_E(MAC, "[MAC] nr_ue_process_mac_pdu, residual mac pdu length %d < 0!\n", pdu_len); } }