Skip to content

Bluetooth: controller: Fix channel map and interval check in CONNECT_IND PDU #33278

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Mar 16, 2021
Merged

Bluetooth: controller: Fix channel map and interval check in CONNECT_IND PDU #33278

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bf8cdec
Bluetooth: controller: Fix channel map check in CONNECT_IND PDU
cvinayak Mar 12, 2021
febf423
Bluetooth: controller: Fix interval check in CONNECT_IND PDU
cvinayak Mar 12, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 37 additions & 12 deletions subsys/bluetooth/controller/ll_sw/ull_slave.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,17 +61,16 @@ void ull_slave_setup(memq_link_t *link, struct node_rx_hdr *rx,
uint8_t peer_addr[BDADDR_SIZE];
uint32_t ticks_slot_overhead;
uint32_t ticks_slot_offset;
uint32_t ready_delay_us;
struct pdu_adv *pdu_adv;
struct ll_adv_set *adv;
struct node_rx_cc *cc;
struct ll_conn *conn;
uint32_t ready_delay_us;
uint32_t ticker_status;
uint8_t peer_addr_type;
uint16_t win_offset;
uint16_t win_delay_us;
struct node_rx_cc *cc;
struct ll_conn *conn;
uint16_t win_offset;
uint16_t timeout;
uint16_t interval;
uint8_t chan_sel;

adv = ((struct lll_adv *)ftr->param)->hdr.parent;
Expand All @@ -85,22 +84,48 @@ void ull_slave_setup(memq_link_t *link, struct node_rx_hdr *rx,
sizeof(lll->data_chan_map));
lll->data_chan_count = util_ones_count_get(&lll->data_chan_map[0],
sizeof(lll->data_chan_map));
if (lll->data_chan_count < 2) {
return;
}
lll->data_chan_hop = pdu_adv->connect_ind.hop;
if ((lll->data_chan_hop < 5) || (lll->data_chan_hop > 16)) {
lll->interval = sys_le16_to_cpu(pdu_adv->connect_ind.interval);
if ((lll->data_chan_count < 2) || (lll->data_chan_hop < 5) ||
(lll->data_chan_hop > 16) || !lll->interval) {
lll->initiated = 0U;

/* Mark for buffer for release */
rx->type = NODE_RX_TYPE_RELEASE;

/* Release CSA#2 related node rx too */
if (IS_ENABLED(CONFIG_BT_CTLR_CHAN_SEL_2)) {
struct node_rx_pdu *rx_csa;

/* pick the rx node instance stored within the
* connection rx node.
*/
rx_csa = (void *)ftr->extra;

/* Enqueue the connection event to be release */
ll_rx_put(link, rx);

/* Use the rx node for CSA event */
rx = (void *)rx_csa;
link = rx->link;

/* Mark for buffer for release */
rx->type = NODE_RX_TYPE_RELEASE;
}

/* Enqueue connection or CSA event to be release */
ll_rx_put(link, rx);
ll_rx_sched();

return;
}

((struct lll_adv *)ftr->param)->conn = NULL;

interval = sys_le16_to_cpu(pdu_adv->connect_ind.interval);
lll->interval = interval;
lll->latency = sys_le16_to_cpu(pdu_adv->connect_ind.latency);

win_offset = sys_le16_to_cpu(pdu_adv->connect_ind.win_offset);
conn_interval_us = interval * CONN_INT_UNIT_US;
conn_interval_us = lll->interval * CONN_INT_UNIT_US;

if (0) {
#if defined(CONFIG_BT_CTLR_ADV_EXT)
Expand Down