When a characteristic declaration is passed instead of a value
attribute, ensure the associated characteristic value attribute
permissions are checked before sending notifications, indications
or multiple notifications.
Signed-off-by: Yuan Ye <1275552818@qq.com>
(cherry picked from commit c3386f92fe)
Fix insufficient buffer length validation in bt_sdp_parse_attribute().
The original check only verified space for the type byte and attribute
ID, but did not account for the type variable itself that is read from
the buffer immediately after the check.
This could lead to a buffer over-read if the buffer contains exactly
sizeof(uint8_t) + sizeof(attr->id) bytes but not enough for the
additional type field.
Add sizeof(type) to the length check to ensure all required data is
present before parsing.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
(cherry picked from commit dfac5224ab)
In `l2cap_br_conf_req()` and `l2cap_br_conf_rsp()`, `buf->len` is used
to validate the minimum packet size. However, `buf->len` may exceed the
actual command data length (the `len` parameter from the L2CAP
signaling header), as the buffer can contain data beyond the current
command.
When the command data length `len` is smaller than the minimum packet
size, but `buf->len` is not less than the minimum packet size, the
validation passes incorrectly. Subsequently, when calculating `opt_len`
(`len - sizeof(*req)`), an underflow occurs duw to the value of type
`uint16_t`, resulting in an out-of-bounds buffer access issue.
Fix by validating against the `len` parameter instead of `buf->len` in
both `l2cap_br_conf_req()` and `l2cap_br_conf_rsp()`, since `len`
reflects the actual command data length.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
(cherry picked from commit 1d45168337)
Fix a race condition in RFCOMM session disconnection when both local
and peer devices initiate disconnection simultaneously.
Add state check in `rfcomm_session_disconnected()` to only transition
to `DISCONNECTED` state if the session is not already in
`DISCONNECTING` state. This prevents the race condition where both
sides set the session to disconnected, causing the disconnection
process to not complete properly and leaving the L2CAP connection
unreleased.
Without this check, subsequent RFCOMM channel connection requests
would fail due to the invalid session state (the expected state is
`IDLE`, while the actual state is `DISCONNECTED`).
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Signed-off-by: David Brown <david.brown@linaro.org>
Assisted-By: Claude:fable-5
Since the Broadcast Assistant implementation may have a
pending request _per_ instance, each instance needs its own
buffer to accomodate that, otherwise we may risk overwriting
data between instances. This follows the design used in the
BAP Unicast Client
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Signed-off-by: David Brown <david.brown@linaro.org>
Assisted-By: Claude:opus-4.8
In prov_msg_recv(), the protocol timer was reset unconditionally at
the top of the function, before the FCS check and before the
ADV_LINK_INVALID check. When the link has been marked invalid (e.g.
after a provisioning failure), any incoming PB-ADV packet with a
passing FCS would still reset the timer, preventing
protocol_timeout() from firing and closing the link via
prov_link_close().
Move k_work_reschedule() to after the ADV_LINK_INVALID check so the
timer is only reset for valid PDUs on an active, non-failed link.
Move the FCS check before the timer reset for the same reason.
Once ADV_LINK_INVALID is set the protocol timer is no longer
extended by incoming packets, and the link is closed by
protocol_timeout() as intended, after which the unprovisioned
device beacon and PB-ADV link acceptance are restored.
Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no>
(cherry picked from commit 3f3c37edf8)
bt_iso_recv pulls the SDU header (with or without) timestamp,
but did not check the length of `buf` before doing so.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
(cherry picked from commit 756b16b643)
In some cases the stream->qos pointer pointed to the
qos argument, and sometimes it pointed to the ep->qos.
Now all qos arguments are copied to ep->qos, and
stream->qos always points to stream->ep.qos.
Some modules had some refactoring done to properly store
the QoS. The unicast client had some additional checks
done or redone, and some now-unused code removed.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Assisted-By: Claude:opus-4.8
Signed-off-by: David Brown <david.brown@linaro.org>
Add validation to ensure the indicator index is within the valid range
of the ind_table array before accessing it in cind_handle_values().
Without this check, an out-of-bounds index could lead to buffer overrun
when the index is used to access hf->ind_table array elements later in
the function.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
(cherry picked from commit cf7693a826)
When sc=0, a framed ISO PDU segment header includes a 3-byte time_offset
field, so seg_hdr->len must be at least PDU_ISO_SEG_TIMEOFFSET_SIZE.
isoal_check_seg_header() accepted segments with sc=0 and len<3 as valid,
allowing isoal_rx_framed_consume() to underflow, causing an
out-of-bounds read of up to 255 bytes of adjacent memory into an HCI ISO
packet delivered to the host.
Signed-off-by: Flavio Ceolin <flavio@hubblenetwork.com>
(cherry picked from commit 28080d80fc)
subnet_keys_destroy() guarded the destroy of keys->priv_beacon with
#if defined(CONFIG_BT_MESH_V1d1), while net_keys_create() guards the
matching import with #if defined(CONFIG_BT_MESH_PRIV_BEACONS).
Commit 981c79b7ce ("Bluetooth: Mesh: Drop explicit support for
Bluetooth Mesh 1.0.1") removed the CONFIG_BT_MESH_V1d1 Kconfig but
left this stray reference behind. With V1d1 gone, the destroy branch
is permanently dead code, so every successful net_keys_create() leaks
one PSA key slot.
In a long-running test that repeatedly provisions and resets a node
(no persistent settings, in-RAM CDB only), the leak accumulates one
PSA volatile-key slot per provisioning round. With the default
CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT=16, bt_mesh_private_beacon_key()
fails after ~12 rounds with:
<err> bt_mesh_net_keys: Unable to generate private beacon key
<err> bt_mesh_net: Failed creating subnet
<err> bt_mesh_main: Failed to create network
Align the destroy guard with the import guard so the leak goes away.
Signed-off-by: Lingao Meng <menglingao@xiaomi.com>
(cherry picked from commit f573da9f53)
validate the assumptions about buffers returned by alloc_buf() in the
LE CoC receive path.
if the returned buffer does not provide enough user_data space for the
internal segment counter, disconnect and drop the buffer instead of
reading or writing past the metadata area.
also document that alloc_buf() must return a buffer with at least
sizeof(uint16_t) bytes of user_data.
Signed-off-by: Oleh Konko <security@1seal.org>
(cherry picked from commit 09ad7174e9)
Fix nRF54Lx DTM implementation when using GRTC. The Radio
start needs to be offset by a maximum ISR latency value that
is less than inter-frame switching, plus minimum counter
compare offset that can be set, plus minimum CPU latency to
set the counter compare register.
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
(cherry picked from commit 53d053359a)
Use clock startup time from devicetree.
Relates to commit 72dac165d8 ("Bluetooth: Controller: Use
OVERHEAD_XTAL_US from devicetree").
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
(cherry picked from commit 5e2e989cdc)
Fix incorrectly high Radio Tx Power being set as default.
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
(cherry picked from commit 2ab41387a4)
Fix a missing unref of a bt_conn reference, leading to a ref count
mismatch, and causing the following warning to be printed:
bt_conn: Found valid connection ... in disconnected state.
Signed-off-by: Aleksandar Stanoev <aleksandar.stanoev@nordicsemi.no>
(cherry picked from commit 1eea6adad2)
Handling of CIS termination had several issues, most notably:
- it depended on allocating a termination node from the general rx
node pool, causing asserts if the pool was exhausted
- CIS established events was not always generated when required,
potentially causing CIS Centrals to get stuck without being able
to create any new CISes
- Cancelling a CIS Create procedure only worked correctly if the
CIS Create was currently active and happened to belong to the
same CIS
- CIG state handling often (always?) assumed a CIG with only one CIS
ll_conn_iso_stream now has a dedicated termination node, same as
ll_conn and ll_sync_iso_set
LLCP statemachine for Cis Create procedure has been reworked to ensure
a notification node for CIS Established is available as early as possible.
In addition, it should now always be sent when needed
Introduced ull_central_iso_all_cises_terminated() to check if all CISes
in a CIG has been terminated (or not created yet) - which is now
used for updating the CIG state
ull_cp_cc_cancel() now takes the CIS to cancel as an argument so
it doesn't end up canceling an entirely different CIS Create procedure;
In addition it now works for queued procedures as well
Flushing a (central) CIS Create procedure in LLCP will now properly
generate a CIS Established event (with an error)
Signed-off-by: Troels Nilsson <trnn@demant.com>
Track may not have next track and thus this must be checked before
trying to match ID.
This was affecting following qualification test cases:
GMCS/SR/MCP/BV-38-C
GMCS/SR/MCP/BV-39-C
GMCS/SR/MCP/BV-40-C
Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl>
When received the DLC disconnect request, after prime the DLC
disconnect response, the DLC will be cleared and the `dlc->session`
is cleared. If the no DLC is linked in current session, the idle
timer of the session will be scheduled.
In current implementation, the `dlc->session` is used to get the
session pointer, but it is invalid in this time. And the unexpected
fault occurs.
Fix the issue by getting the session pointer from parameter of the
function `rfcomm_handle_disc()` instead of `dlc->session`.
Fix issue #99035.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Bluetooth 6.2 has version number 0x10 and was released in November 2025.
This commit ensures this version number is properly decoded.
Signed-off-by: Aleksandar Stanoev <aleksandar.stanoev@nordicsemi.no>
When building an observer-only build the check_pending_conn label would
result in CI warnings/errors due to this only being a C23 feature:
scan.c:692:1: error: label at end of compound statement is a C23 extension
Turns out the #ifdefs are completely unnecessary, and the code can simply
take advantage of IS_ENABLED(), which should get rid of the warning.
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
In some cases, the host starts scanning internally for establishing
connections (BT_LE_SCAN_USER_CONN), such as host-based resolving or
auto-connection. In this situation, even if the application does not
start explicit scan, the host still needs to handle the advertising
reports to continue the connection process.
Previously, both bt_hci_le_adv_report() and bt_hci_le_adv_ext_report()
will break or discard all reports when explicit scan is not active.
This causes the connection to stay in SCAN_BEFORE_INITIATING and never
move forward.
This patch adds checking of BT_LE_SCAN_USER_CONN to allow advertising
reports to be processed during connection-purpose scanning. When the
scan is started explicitly by application, the behavior remains the
same, only small comments are updated to describe this behavior and keep
the original code style unchanged.
Signed-off-by: Zhijie Zhong <zhongzhijie1@xiaomi.com>
There is no guarantess enum will be packed so passing uint8_t as
node_id to bt_mesh_subnet_priv_node_id_get() could (and likely will)
result in writing past stack variable.
Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl>
rootcause: The dynamic L2CAP channel rx.cid is not reset, it
will be intercepted by the judgment condition of the fixed channel,
directly using the last alloced cid may cause cid conflict.
Co-authored-by: zhenwei fang <fangzhenwei@bytedance.com>
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
When limited advertising is enabled there is pending deleyable work
for timing it out. If in such case struct bt_le_ext_adv is cleared by
memset system will crash on next tick.
Fix this by ensuring work is cancelled before clearing struct
bt_le_ext_adv. Using bt_le_ext_adv_foreach() ensures that this will
be correctly handled with and without extended advertising enabled.
Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl>
When creating the audio connection, the SCO connection request will be
sent before the response "OK" to AT command "AT+BCS" is issued.
It causes the issue that the HFP HF cannot response the SCO connection
request with the correct codec. Then the SCO connection cannot be
established properly.
Put all processing into the same context, thus avoiding non-sequential
execution caused by the different priorities of different threads.
Add a flag `BT_HFP_AG_AT_PROCESS` to flag the AT command is being
processed.
When the flag `BT_HFP_AG_AT_PROCESS` is set, put the pending
executions into temp list `tx_submit_pending`. After the AT response
`OK` or `ERROR` has been sent, move the pending executions from
`tx_submit_pending` to `tx_pending`.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Fix use-after-release in lll_scan/lll_scan_aux when using
mayfly_enqueue to defer execution of the offset calculation
using ull_sched_mfy_after_cen_offset_get().
Apply suggestion from @Copilot
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
If the CIG and ACL overlap each other when the CIS is starting
zephyr will assert on negative time, so fit this special case.
Signed-off-by: Lars Segerlund <lrsu@demant.com>
When multiple relay adv sets are used, the bt_mesh_adv_send function
calls bt_mesh_adv_relay_ready which should distribute relayed
advertisements across all relay adv sets.
Until the submitted relay adv set work is started, the ADV_FLAG_ACTIVE
is not set. Therefore, next call to bt_mesh_adv_send will try to
re-submit the same relay adv set work, instead of picking up another
relay set which is actually free and ready to send an advertisement.
This commit adds a check that checks if the adv set work is already
pending to be executed. And if so, schedule_send returns false to make
bt_mesh_adv_relay_ready pick next relay adv set.
This shouldn't brake advertising because once adv set is done
transmitting advertisment, it will pick up a next one.
The ADV_FLAG_PROXY check is added to do re-submit for adv set which was
used for proxy advertisement since we need to prioritize mesh messages
over proxy advertisements when those are running on the same adv set.
Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>
The `bt_le_ext_adv_update_param` will set new random address when option
not select `BT_LE_ADV_OPT_USE_IDENTITY`, But `bt_le_ext_adv_start` will
also set random address again.
This will be affect bluetooth mesh, after this change, will ensure address
only change once for every advertising.
Signed-off-by: Lingao Meng <menglingao@xiaomi.com>
Add bt_bap_unicast_client_unregister_cb to unregister BAP
unicast client callbacks. This is required for unittests
to clean up between runs.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Introduce dedicated helper functions for connection type checking:
- bt_conn_is_br() for BR/EDR connections
- bt_conn_is_le() for LE connections
- bt_conn_is_iso() for ISO connections
- bt_conn_is_sco() for SCO connections
Replace direct conn->type comparisons with these new helper functions
throughout the connection management code. This improves code readability,
maintainability, and provides proper configuration checks for each
connection type.
Signed-off-by: Kai Cheng <chengkai@xiaomi.com>
Use a combination of multiple helper functions to implement the
functionality of existing interfaces starting with `bt_sdp_get_`.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Update the command `sdp-find` to support attribute parsing helper.
If the argument count is 1, the general SDP discovery will be used
to discover the protocol `L2CAP`.
In the SDP record discovered callback, call attribute parsing helper
functions to parse the SDP record and SDP attributes. And print all
parsed attribute values.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The current implementation does not support multiple attributes with
the same attribute identifier in a discovered SDP record.
Add function `bt_sdp_record_parse()` to parse the received SDP record.
Add function `bt_sdp_has_attr()` to check if the specified attribute
identifier has been discovered.
Add function `bt_sdp_get_attr()` to get the attribute of specified
attribute identifier.
Add function `bt_sdp_attr_value_parse()` to parse the attribute value.
Add function `bt_sdp_attr_has_uuid()` to check if the attribute
contains the specified UUID.
Add function `bt_sdp_attr_read()` to read the value of the attribute.
Add function `bt_sdp_attr_addl_proto_parse()` to parse the protocol
descriptor from the additional protocol descriptor list.
Add function `bt_sdp_attr_addl_proto_count()` to get the protocol
descriptor count of the additional protocol descriptor list.
Add function `bt_sdp_attr_addl_proto_read()` to read the attribute
value from the additional protocol descriptor list for specific index
and UUID.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
This local pointer assignment does nothing and readers may get a wrong
interpretation of the intention of the function.
Signed-off-by: Ricardo Cañuelo Navarro <rcn@igalia.com>
Add code comments explaining the handling of short prepare
that can be enqueued out of order and present in use of FIFO
for prepare pipeline.
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
In the case of a CIG having multiple CIS, and all CIS has been
requested to being disconnected (i.e. they all enter the
BT_ISO_STATE_DISCONNECTING state), then when the first disconnect
complete is handled in bt_iso_chan_disconnected, then the
cig->state was prematurely set to BT_ISO_CIG_STATE_INACTIVE.
This meant that if the application called bt_iso_cig_terminate
when the 2nd CIS entered bt_iso_chan_disconnected and called
chan->ops->disconnected(chan, reason) then the CIG would be
removed. When the CIS then entered bt_iso_cleanup_acl, it
would access removed data from cleanup_cig.
Change bt_iso_chan_disconnected to not allow the termination
of the CIG until all CIS have entered the BT_ISO_STATE_DISCONNECTED
state.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Reduce Controller assertion check code size for ARM Cortex-M
CPUs by using the undefined instruction exception.
`arm-none-eabi-addr2line` commandline can be used to get the
source file and line number.
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
