Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bluetooth: controller: Add conn creation param checks #35527

Merged
merged 1 commit into from
May 21, 2021
Merged

Bluetooth: controller: Add conn creation param checks #35527

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 62 additions & 1 deletion subsys/bluetooth/controller/hci/hci.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1604,6 +1604,43 @@ static void le_big_terminate_sync(struct net_buf *buf, struct net_buf **evt,

#if defined(CONFIG_BT_CONN)
#if defined(CONFIG_BT_CENTRAL)

static uint8_t check_cconn_params(bool ext, uint16_t scan_interval,
uint16_t scan_window,
uint16_t conn_interval_max,
uint16_t conn_latency,
uint16_t supervision_timeout)
{
if (scan_interval < 0x0004 || scan_window < 0x0004 ||
(!ext && (scan_interval > 0x4000 || scan_window > 0x4000))) {
return BT_HCI_ERR_INVALID_PARAM;
}

if (conn_interval_max < 0x0006 || conn_interval_max > 0x0C80) {
return BT_HCI_ERR_INVALID_PARAM;
}

if (conn_latency > 0x01F3) {
return BT_HCI_ERR_INVALID_PARAM;
}

if (supervision_timeout < 0x000A || supervision_timeout > 0x0C80) {
return BT_HCI_ERR_INVALID_PARAM;
}

/* sto * 10ms > (1 + lat) * ci * 1.25ms * 2
* sto * 10 > (1 + lat) * ci * 2.5
* sto * 2 > (1 + lat) * ci * 0.5
* sto * 4 > (1 + lat) * ci
*/
if ((supervision_timeout << 2) <= ((1 + conn_latency) *
conn_interval_max)) {
return BT_HCI_ERR_INVALID_PARAM;
}

return 0;
}

static void le_create_connection(struct net_buf *buf, struct net_buf **evt)
{
struct bt_hci_cp_le_create_conn *cmd = (void *)buf->data;
Expand All @@ -1625,6 +1662,18 @@ static void le_create_connection(struct net_buf *buf, struct net_buf **evt)
conn_latency = sys_le16_to_cpu(cmd->conn_latency);
supervision_timeout = sys_le16_to_cpu(cmd->supervision_timeout);

if (IS_ENABLED(CONFIG_BT_CTLR_PARAM_CHECK)) {
status = check_cconn_params(false, scan_interval,
scan_window,
conn_interval_max,
conn_latency,
supervision_timeout);
if (status) {
*evt = cmd_status(status);
return;
}
}

#if defined(CONFIG_BT_CTLR_ADV_EXT)
status = ll_create_connection(scan_interval, scan_window,
cmd->filter_policy,
Expand Down Expand Up @@ -3222,7 +3271,7 @@ static void le_ext_create_connection(struct net_buf *buf, struct net_buf **evt)
return;
}

/* TODO: add parameter checks */
/* TODO: add additional parameter checks */

filter_policy = cmd->filter_policy;
own_addr_type = cmd->own_addr_type;
Expand Down Expand Up @@ -3258,6 +3307,18 @@ static void le_ext_create_connection(struct net_buf *buf, struct net_buf **evt)
supervision_timeout =
sys_le16_to_cpu(p->supervision_timeout);

if (IS_ENABLED(CONFIG_BT_CTLR_PARAM_CHECK)) {
status = check_cconn_params(true, scan_interval,
scan_window,
conn_interval_max,
conn_latency,
supervision_timeout);
if (status) {
*evt = cmd_status(status);
return;
}
}

status = ll_create_connection(scan_interval,
scan_window,
filter_policy,
Expand Down