Commit f736498b authored by Vinayak Kariappa Chettimada's avatar Vinayak Kariappa Chettimada Committed by Carles Cufi
Browse files

Bluetooth: Controller: Fix parent PDU's aux offset in aux ptr field 



Fix Extended Advertising and Periodic Advertising's parent
PDU's aux ptr field to contain correct aux offset value to
its chain PDU.

Uninitialized pointer reference to aux ptr in the parent PDU
was used before the pointer reference was returned by the
function adding the aux ptr fields in the parent PDU.

Signed-off-by: default avatarVinayak Kariappa Chettimada <vich@nordicsemi.no>
parent a08e8ef8

subsys/bluetooth/controller/ll_sw/ull_adv_aux.c

+14 −14
Original line number Diff line number Diff line
@@ -408,11 +408,6 @@ uint8_t ll_adv_aux_ad_data_set(uint8_t handle, uint8_t op, uint8_t frag_pref, 
		uint16_t sec_len;

		uint8_t *dptr;



		/* Get reference to aux ptr in superior PDU */

		(void)memcpy(&aux_ptr,

			     &hdr_data[ULL_ADV_HDR_DATA_AUX_PTR_PTR_OFFSET],

			     sizeof(aux_ptr));



		/* Get reference to flags in superior PDU */

		com_hdr = &pdu->adv_ext_ind;

		if (com_hdr->ext_hdr_len) {
@@ -545,6 +540,11 @@ uint8_t ll_adv_aux_ad_data_set(uint8_t handle, uint8_t op, uint8_t frag_pref, 
		/* Fill AD Data in chain PDU */

		(void)memcpy(dptr_chain, data, len);



		/* Get reference to aux ptr in superior PDU */

		(void)memcpy(&aux_ptr,

			     &hdr_data[ULL_ADV_HDR_DATA_AUX_PTR_PTR_OFFSET],

			     sizeof(aux_ptr));



		/* Fill the aux offset in the previous AUX_SYNC_IND PDU */

		offs_us = PDU_AC_US(pdu->len, adv->lll.phy_s,

				    adv->lll.phy_flags) +
@@ -1032,15 +1032,6 @@ uint8_t ll_adv_aux_sr_data_set(uint8_t handle, uint8_t op, uint8_t frag_pref, 
		uint16_t sec_len;

		uint8_t *dptr;



		/* Get reference to aux ptr in superior PDU */

		aux_ptr_offset = ULL_ADV_HDR_DATA_AUX_PTR_PTR_OFFSET;

		if (hdr_add_fields & ULL_ADV_PDU_HDR_FIELD_ADI) {

			aux_ptr_offset +=  ULL_ADV_HDR_DATA_ADI_PTR_OFFSET +

					   ULL_ADV_HDR_DATA_ADI_PTR_SIZE;

		}

		(void)memcpy(&aux_ptr, &hdr_data[aux_ptr_offset],

			     sizeof(aux_ptr));



		/* Get reference to flags in superior PDU */

		com_hdr = &sr_pdu->adv_ext_ind;

		if (com_hdr->ext_hdr_len) {
@@ -1173,6 +1164,15 @@ uint8_t ll_adv_aux_sr_data_set(uint8_t handle, uint8_t op, uint8_t frag_pref, 
		/* Fill AD Data in chain PDU */

		(void)memcpy(dptr_chain, data, len);



		/* Get reference to aux ptr in superior PDU */

		aux_ptr_offset = ULL_ADV_HDR_DATA_AUX_PTR_PTR_OFFSET;

		if (hdr_add_fields & ULL_ADV_PDU_HDR_FIELD_ADI) {

			aux_ptr_offset +=  ULL_ADV_HDR_DATA_ADI_PTR_OFFSET +

					   ULL_ADV_HDR_DATA_ADI_PTR_SIZE;

		}

		(void)memcpy(&aux_ptr, &hdr_data[aux_ptr_offset],

			     sizeof(aux_ptr));



		/* Fill the aux offset in the previous AUX_SYNC_IND PDU */

		offs_us = PDU_AC_US(sr_pdu->len, adv->lll.phy_s,

				    adv->lll.phy_flags) +

subsys/bluetooth/controller/ll_sw/ull_adv_sync.c

+5 −5
Original line number Diff line number Diff line
@@ -473,11 +473,6 @@ uint8_t ll_adv_sync_ad_data_set(uint8_t handle, uint8_t op, uint8_t len, 
		uint16_t ter_len;

		uint8_t *dptr;



		/* Get reference to aux ptr in superior PDU */

		(void)memcpy(&aux_ptr,

			     &hdr_data[ULL_ADV_HDR_DATA_AUX_PTR_PTR_OFFSET],

			     sizeof(aux_ptr));



		/* Get reference to flags in superior PDU */

		com_hdr = &pdu->adv_ext_ind;

		if (com_hdr->ext_hdr_len) {
@@ -609,6 +604,11 @@ uint8_t ll_adv_sync_ad_data_set(uint8_t handle, uint8_t op, uint8_t len, 
		/* Fill AD Data in chain PDU */

		(void)memcpy(dptr_chain, data, len);



		/* Get reference to aux ptr in superior PDU */

		(void)memcpy(&aux_ptr,

			     &hdr_data[ULL_ADV_HDR_DATA_AUX_PTR_PTR_OFFSET],

			     sizeof(aux_ptr));



		/* Fill the aux offset in the previous AUX_SYNC_IND PDU */

		offs_us = PDU_AC_US(pdu->len, adv->lll.phy_s,

				    adv->lll.phy_flags) +

CRA Git | Maintained and supported by SUSTech CRA and CCSE