[backport v2.2] Bluetooth: controller: split: Validate chan map and hop value #23963
Conversation
There was a problem hiding this comment.
Why is the compare '< 2' and not '< 1' ?
There was a problem hiding this comment.
4.5.8.1 Channel classification
The master’s, periodic advertiser’s, and isochronous broadcaster’s Link Layer
shall classify the RF channels in the general-purpose group into used channels
(used for transmitting data) and unused channels (not used for transmitting
data). This is called the channel map. The minimum number of used channels
shall be 2.
There was a problem hiding this comment.
@cvinayak The function "util ones_count_get" detects all bits, which will result in including 37 38 39 channels. When the channel map is equal to 0xE000000000, Zephyr will bypass the channel detection and use the broadcast channel for communication.
Should this be considered？
There was a problem hiding this comment.
This does not cause any fatal error in the implementation. Do send a pull request to add the checks.
cvinayak
force-pushed
the
github_chap_map_hop_v2.2_fix
branch
from
d55ac93 to
5541fe9
Compare
Add validation of channel map and hop increment value received in CONNECT_IND PDU. Zero bit count leads to controller assert or divide-by-zero fault. Hop increment shall be between 5 and 16 by BT Specification. Relates to zephyrproject-rtos#23705. Signed-off-by: Vinayak Kariappa Chettimada <[email protected]>
cvinayak
force-pushed
the
github_chap_map_hop_v2.2_fix
branch
from
5541fe9 to
c264010
Compare
Add validation of channel map and hop increment value
received in CONNECT_IND PDU.
Zero bit count leads to controller assert or divide-by-zero
fault.
Hop increment shall be between 5 and 16 by BT Specification.
Relates to #23705.
Signed-off-by: Vinayak Kariappa Chettimada [email protected]