avoid TDA index assertion by rejecting the DCI with invalid parameter

openair2/LAYER2/NR_MAC_COMMON/nr_mac.h

@@ -614,6 +614,7 @@ typedef struct NR_tda_info {
   int startSymbolIndex;
   int nrOfSymbols;
   long k2;
+  bool valid_tda;
 } NR_tda_info_t;
 
 #endif /*__LAYER2_MAC_H__ */

openair2/LAYER2/NR_MAC_COMMON/nr_mac_common.c

@@ -467,7 +467,11 @@ NR_tda_info_t get_ul_tda_info(const NR_UE_UL_BWP_t *ul_bwp,
   AssertFatal(scs >= 0 &&  scs < 5, "Subcarrier spacing indicatior %d invalid value\n", scs);
   int j = scs == 0 ? 1 : scs;
   if (tdalist) {
-    AssertFatal(tda_index < tdalist->list.count, "TDA index from DCI %d exceeds TDA list array size %d\n", tda_index, tdalist->list.count);
+    tda_info.valid_tda = tda_index < tdalist->list.count;
+    if (!tda_info.valid_tda) {
+      LOG_E(NR_MAC, "TDA index from DCI %d exceeds TDA list array size %d\n", tda_index, tdalist->list.count);
+      return tda_info;
+    }
     NR_PUSCH_TimeDomainResourceAllocation_t *tda = tdalist->list.array[tda_index];
     tda_info.mapping_type = tda->mappingType;
     // As described in 38.331, when the field is absent the UE applies the value 1 when PUSCH SCS is 15/30KHz
@@ -479,6 +483,11 @@ NR_tda_info_t get_ul_tda_info(const NR_UE_UL_BWP_t *ul_bwp,
     tda_info.nrOfSymbols = L;
   } else {
     bool normal_CP = ul_bwp->cyclicprefix ? false : true;
+    tda_info.valid_tda = tda_index < 16;
+    if (!tda_info.valid_tda) {
+      LOG_E(NR_MAC, "TDA index from DCI %d exceeds default TDA list array size %d\n", tda_index, 16);
+      return tda_info;
+    }
     if (normal_CP) {
       tda_info.mapping_type = table_6_1_2_1_1_2[tda_index][0];
       tda_info.k2 = table_6_1_2_1_1_2[tda_index][1] + j;
@@ -500,6 +509,11 @@ NR_tda_info_t get_info_from_tda_tables(default_table_type_t table_type,
                                        int normal_CP)
 {
   NR_tda_info_t tda_info = {0};
+  tda_info.valid_tda = tda < 16;
+  if (!tda_info.valid_tda) {
+    LOG_E(NR_MAC, "TDA index from DCI %d exceeds default TDA list array size %d\n", tda, 16);
+    return tda_info;
+  }
   bool is_mapping_typeA;
   int k0 = 0;
   switch(table_type){
@@ -586,7 +600,11 @@ default_table_type_t get_default_table_type(int mux_pattern)
 NR_tda_info_t set_tda_info_from_list(NR_PDSCH_TimeDomainResourceAllocationList_t *tdalist, int tda_index)
 {
   NR_tda_info_t tda_info = {0};
-  AssertFatal(tda_index < tdalist->list.count, "TDA index from DCI %d exceeds TDA list array size %d\n", tda_index, tdalist->list.count);
+  tda_info.valid_tda = tda_index < tdalist->list.count;
+  if (!tda_info.valid_tda) {
+    LOG_E(NR_MAC, "TDA index from DCI %d exceeds TDA list array size %d\n", tda_index, tdalist->list.count);
+    return tda_info;
+  }
   NR_PDSCH_TimeDomainResourceAllocation_t *tda = tdalist->list.array[tda_index];
   tda_info.mapping_type = tda->mappingType;
   int S, L;

openair2/LAYER2/NR_MAC_UE/nr_ue_procedures.c

@@ -435,11 +435,12 @@ static int nr_ue_process_dci_ul_00(NR_UE_MAC_INST_t *mac,
                                            dci_ind->ss_type,
                                            get_rnti_type(mac, dci_ind->rnti),
                                            dci->time_domain_assignment.val);
-  frame_t frame_tx;
-  int slot_tx;
-  if (tda_info.nrOfSymbols == 0)
+
+  if (!tda_info.valid_tda || tda_info.nrOfSymbols == 0)
     return -1;
 
+  frame_t frame_tx;
+  int slot_tx;
   if (-1 == nr_ue_pusch_scheduler(mac, 0, frame, slot, &frame_tx, &slot_tx, tda_info.k2)) {
     LOG_E(MAC, "Cannot schedule PUSCH\n");
     return -1;
@@ -525,6 +526,9 @@ static int nr_ue_process_dci_ul_01(NR_UE_MAC_INST_t *mac,
                                            get_rnti_type(mac, dci_ind->rnti),
                                            dci->time_domain_assignment.val);
 
+  if (!tda_info.valid_tda || tda_info.nrOfSymbols == 0)
+    return -1;
+
   if (dci->ulsch_indicator == 0) {
     // in case of CSI on PUSCH and no ULSCH we need to use reportSlotOffset in trigger state
     if (csi_K2 <= 0) {
@@ -534,9 +538,6 @@ static int nr_ue_process_dci_ul_01(NR_UE_MAC_INST_t *mac,
     tda_info.k2 = csi_K2;
   }
 
-  if (tda_info.nrOfSymbols == 0)
-    return -1;
-
   if (-1 == nr_ue_pusch_scheduler(mac, 0, frame, slot, &frame_tx, &slot_tx, tda_info.k2)) {
     LOG_E(MAC, "Cannot schedule PUSCH\n");
     return -1;
@@ -682,6 +683,8 @@ static int nr_ue_process_dci_dl_10(NR_UE_MAC_INST_t *mac,
                                            rnti_type,
                                            coreset_type,
                                            mac->get_sib1);
+  if (!tda_info.valid_tda)
+    return -1;
 
   dlsch_pdu->number_symbols = tda_info.nrOfSymbols;
   dlsch_pdu->start_symbol = tda_info.startSymbolIndex;
@@ -993,6 +996,8 @@ static int nr_ue_process_dci_dl_11(NR_UE_MAC_INST_t *mac,
                                            rnti_type,
                                            coreset_type,
                                            false);
+  if (!tda_info.valid_tda)
+    return -1;
 
   dlsch_pdu->number_symbols = tda_info.nrOfSymbols;
   dlsch_pdu->start_symbol = tda_info.startSymbolIndex;
@@ -3952,7 +3957,7 @@ static void nr_ue_process_rar(NR_UE_MAC_INST_t *mac, nr_downlink_indication_t *d
                                              pdcch_config->ra_SS->searchSpaceType->present,
                                              TYPE_RA_RNTI_,
                                              rar_grant.Msg3_t_alloc);
-    if (tda_info.nrOfSymbols == 0) {
+    if (!tda_info.valid_tda || tda_info.nrOfSymbols == 0) {
       LOG_E(MAC, "Cannot schedule Msg3. Something wrong in TDA information\n");
       return;
     }

openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_RA.c

@@ -1271,6 +1271,8 @@ static void nr_generate_Msg2(module_id_t module_idP,
                                            TYPE_RA_RNTI_,
                                            coresetid,
                                            false);
+  if (!tda_info.valid_tda)
+    return;
 
   uint16_t *vrb_map = cc[CC_id].vrb_map;
   for (int i = 0; (i < rbSize) && (rbStart <= (BWPSize - rbSize)); i++) {
@@ -1804,6 +1806,8 @@ static void nr_generate_Msg4(module_id_t module_idP,
                                              TYPE_TC_RNTI_,
                                              coreset->controlResourceSetId,
                                              false);
+    if (!msg4_tda.valid_tda)
+      return;
 
     NR_pdsch_dmrs_t dmrs_info = get_dl_dmrs_params(scc,
                                                    dl_bwp,

openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_dlsch.c

@@ -455,6 +455,8 @@ static bool allocate_dl_retransmission(module_id_t module_id,
                                            TYPE_C_RNTI_,
                                            coresetid,
                                            false);
+  if (!temp_tda.valid_tda)
+    return false;
 
   bool reuse_old_tda = (retInfo->tda_info.startSymbolIndex == temp_tda.startSymbolIndex) && (retInfo->tda_info.nrOfSymbols <= temp_tda.nrOfSymbols);
   LOG_D(NR_MAC, "[UE %x] %s old TDA, %s number of layers\n",
@@ -775,6 +777,7 @@ static void pf_dl(module_id_t module_id,
                                             TYPE_C_RNTI_,
                                             coresetid,
                                             false);
+    AssertFatal(sched_pdsch->tda_info.valid_tda, "Invalid TDA from get_dl_tda_info\n");
 
     NR_tda_info_t *tda_info = &sched_pdsch->tda_info;
 

openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_phytest.c

@@ -75,6 +75,8 @@ void nr_preprocessor_phytest(module_id_t module_id,
                                            TYPE_C_RNTI_,
                                            sched_ctrl->coreset->controlResourceSetId,
                                            false);
+  if(!tda_info.valid_tda)
+    return;
 
   sched_ctrl->sched_pdsch.tda_info = tda_info;
   sched_ctrl->sched_pdsch.time_domain_allocation = tda;
@@ -271,18 +273,15 @@ bool nr_ul_preprocessor_phytest(module_id_t module_id, frame_t frame, sub_frame_
                                            sched_ctrl->search_space->searchSpaceType->present,
                                            TYPE_C_RNTI_,
                                            tda);
+  if (!tda_info.valid_tda)
+    return false;
   sched_ctrl->sched_pusch.tda_info = tda_info;
 
   const int buffer_index = ul_buffer_index(sched_frame, sched_slot, mu, nr_mac->vrb_map_UL_size);
   uint16_t *vrb_map_UL = &nr_mac->common_channels[CC_id].vrb_map_UL[buffer_index * MAX_BWP_SIZE];
   for (int i = rbStart; i < rbStart + rbSize; ++i) {
     if ((vrb_map_UL[i+BWPStart] & SL_to_bitmap(tda_info.startSymbolIndex, tda_info.nrOfSymbols)) != 0) {
-      LOG_E(MAC,
-            "%s(): %4d.%2d RB %d is already reserved, cannot schedule UE\n",
-            __func__,
-            frame,
-            slot,
-            i);
+      LOG_E(MAC, "%4d.%2d RB %d is already reserved, cannot schedule UE\n", frame, slot, i);
       return false;
     }
   }

openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_ulsch.c

@@ -1601,6 +1601,8 @@ static bool allocate_ul_retransmission(gNB_MAC_INST *nrmac,
                                            sched_ctrl->search_space->searchSpaceType->present,
                                            TYPE_C_RNTI_,
                                            tda);
+  if (!tda_info.valid_tda)
+    return false;
   bool reuse_old_tda = (retInfo->tda_info.startSymbolIndex == tda_info.startSymbolIndex) && (retInfo->tda_info.nrOfSymbols <= tda_info.nrOfSymbols);
   if (reuse_old_tda && nrOfLayers == retInfo->nrOfLayers) {
     /* Check the resource is enough for retransmission */
@@ -1844,6 +1846,7 @@ static void pf_ul(module_id_t module_id,
                                               sched_ctrl->search_space->searchSpaceType->present,
                                               TYPE_C_RNTI_,
                                               sched_pusch->time_domain_allocation);
+      AssertFatal(sched_pusch->tda_info.valid_tda, "Invalid TDA from get_ul_tda_info\n");
       sched_pusch->dmrs_info = get_ul_dmrs_params(scc,
                                                   current_BWP,
                                                   &sched_pusch->tda_info,
@@ -1967,6 +1970,7 @@ static void pf_ul(module_id_t module_id,
                                             sched_ctrl->search_space->searchSpaceType->present,
                                             TYPE_C_RNTI_,
                                             sched_pusch->time_domain_allocation);
+    AssertFatal(sched_pusch->tda_info.valid_tda, "Invalid TDA from get_ul_tda_info\n");
     sched_pusch->dmrs_info = get_ul_dmrs_params(scc,
                                                 current_BWP,
                                                 &sched_pusch->tda_info,