Commit d8f4759c authored by Vinayak Kariappa Chettimada's avatar Vinayak Kariappa Chettimada Committed by Carles Cufi
Browse files

Bluetooth: Controller: Fail on multiple PHY use in PHY_UPDATE_IND 



Disconnect connection if peer central uses multiple PHYs in
PHY_UPDATE_IND PDU.

Signed-off-by: default avatarVinayak Kariappa Chettimada <vich@nordicsemi.no>
parent 17d2e9d0

subsys/bluetooth/controller/ll_sw/ull_conn.c

+17 −0
Original line number Diff line number Diff line
@@ -5463,6 +5463,7 @@ static inline uint8_t phy_upd_ind_recv(struct ll_conn *conn, memq_link_t *link, 
{

	struct pdu_data_llctrl_phy_upd_ind *ind = &pdu_rx->llctrl.phy_upd_ind;

	uint16_t instant;

	uint8_t phy;



	/* Both tx and rx PHY unchanged */

	if (!((ind->m_to_s_phy | ind->s_to_m_phy) & 0x07)) {
@@ -5504,6 +5505,22 @@ static inline uint8_t phy_upd_ind_recv(struct ll_conn *conn, memq_link_t *link, 
		return 0;

	}



	/* Fail on multiple PHY specified */

	phy = ind->m_to_s_phy;

	if (util_ones_count_get(&phy, sizeof(phy)) > 1U) {

		/* Mark for buffer for release */

		(*rx)->hdr.type = NODE_RX_TYPE_RELEASE;



		return BT_HCI_ERR_INVALID_LL_PARAM;

	}

	phy = ind->s_to_m_phy;

	if (util_ones_count_get(&phy, sizeof(phy)) > 1U) {

		/* Mark for buffer for release */

		(*rx)->hdr.type = NODE_RX_TYPE_RELEASE;



		return BT_HCI_ERR_INVALID_LL_PARAM;

	}



	/* instant passed */

	instant = sys_le16_to_cpu(ind->instant);

	if (((instant - conn->lll.event_counter) & 0xffff) > 0x7fff) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE