Bluetooth: controller: Fix incorrect prev aux header flag access

Fix Extended Advertising PDU population from incorrectly
populating new PDU when there is no common extended header
flags being set in the previous PDU and or the new PDU.

Signed-off-by: Vinayak Kariappa Chettimada <[email protected]>

Author: cvinayak

subsys/bluetooth/controller/ll_sw/ull_adv.c

@@ -672,10 +672,16 @@ uint8_t ll_adv_enable(uint8_t enable)
 #if defined(CONFIG_BT_CTLR_ADV_EXT)
 	} else if (pdu_adv->type == PDU_ADV_TYPE_EXT_IND) {
 		struct pdu_adv_com_ext_adv *pri_com_hdr;
+		struct pdu_adv_ext_hdr pri_hdr_flags;
 		struct pdu_adv_ext_hdr *pri_hdr;
 
 		pri_com_hdr = (void *)&pdu_adv->adv_ext_ind;
 		pri_hdr = (void *)pri_com_hdr->ext_hdr_adv_data;
+		if (pri_com_hdr->ext_hdr_len) {
+			pri_hdr_flags = *pri_hdr;
+		} else {
+			*(uint8_t *)&pri_hdr_flags = 0U;
+		}
 
 		if (pri_com_hdr->adv_mode & BT_HCI_LE_ADV_PROP_SCAN) {
 			struct pdu_adv *sr = lll_adv_scan_rsp_peek(lll);
@@ -686,20 +692,26 @@ uint8_t ll_adv_enable(uint8_t enable)
 		}
 
 		/* AdvA, fill here at enable */
-		if (pri_hdr->adv_addr) {
+		if (pri_hdr_flags.adv_addr) {
 			pdu_adv_to_update = pdu_adv;
 #if (CONFIG_BT_CTLR_ADV_AUX_SET > 0)
-		} else if (pri_hdr->aux_ptr) {
+		} else if (pri_hdr_flags.aux_ptr) {
 			struct pdu_adv_com_ext_adv *sec_com_hdr;
+			struct pdu_adv_ext_hdr sec_hdr_flags;
 			struct pdu_adv_ext_hdr *sec_hdr;
 			struct pdu_adv *sec_pdu;
 
 			sec_pdu = lll_adv_aux_data_peek(lll->aux);
 
 			sec_com_hdr = (void *)&sec_pdu->adv_ext_ind;
 			sec_hdr = (void *)sec_com_hdr->ext_hdr_adv_data;
+			if (sec_com_hdr->ext_hdr_len) {
+				sec_hdr_flags = *sec_hdr;
+			} else {
+				*(uint8_t *)&sec_hdr_flags = 0U;
+			}
 
-			if (sec_hdr->adv_addr) {
+			if (sec_hdr_flags.adv_addr) {
 				pdu_adv_to_update = sec_pdu;
 			}
 #endif /* (CONFIG_BT_CTLR_ADV_AUX_SET > 0) */
@@ -1659,10 +1671,19 @@ void ull_adv_done(struct node_rx_event_done *done)
 const uint8_t *ull_adv_pdu_update_addrs(struct ll_adv_set *adv,
 					struct pdu_adv *pdu)
 {
+	const uint8_t *adv_addr;
+
 #if defined(CONFIG_BT_CTLR_ADV_EXT)
-	struct pdu_adv_ext_hdr *hdr = (void *)pdu->adv_ext_ind.ext_hdr_adv_data;
+	struct pdu_adv_com_ext_adv *com_hdr = (void *)&pdu->adv_ext_ind;
+	struct pdu_adv_ext_hdr *hdr = (void *)com_hdr->ext_hdr_adv_data;
+	struct pdu_adv_ext_hdr hdr_flags;
+
+	if (com_hdr->ext_hdr_len) {
+		hdr_flags = *hdr;
+	} else {
+		*(uint8_t *)&hdr_flags = 0U;
+	}
 #endif
-	const uint8_t *adv_addr;
 
 	adv_addr = adva_update(adv, pdu);
 
@@ -1672,7 +1693,7 @@ const uint8_t *ull_adv_pdu_update_addrs(struct ll_adv_set *adv,
 	 */
 	if ((pdu->type == PDU_ADV_TYPE_DIRECT_IND) ||
 #if defined(CONFIG_BT_CTLR_ADV_EXT)
-	    ((pdu->type == PDU_ADV_TYPE_EXT_IND) && hdr->tgt_addr) ||
+	    ((pdu->type == PDU_ADV_TYPE_EXT_IND) && hdr_flags.tgt_addr) ||
 #endif
 	    0) {
 		tgta_update(adv, pdu);
@@ -2117,12 +2138,21 @@ static inline uint8_t disable(uint8_t handle)
 static inline uint8_t *adv_pdu_adva_get(struct pdu_adv *pdu)
 {
 #if defined(CONFIG_BT_CTLR_ADV_EXT)
-	struct pdu_adv_ext_hdr *hdr = (void *)pdu->adv_ext_ind.ext_hdr_adv_data;
+	struct pdu_adv_com_ext_adv *com_hdr = (void *)&pdu->adv_ext_ind;
+	struct pdu_adv_ext_hdr *hdr = (void *)com_hdr->ext_hdr_adv_data;
+	struct pdu_adv_ext_hdr hdr_flags;
+
+	if (com_hdr->ext_hdr_len) {
+		hdr_flags = *hdr;
+	} else {
+		*(uint8_t *)&hdr_flags = 0U;
+	}
 
 	/* All extended PDUs have AdvA at the same offset in common header */
 	if (pdu->type == PDU_ADV_TYPE_EXT_IND) {
-		LL_ASSERT(hdr->adv_addr);
-		return &pdu->adv_ext_ind.ext_hdr_adv_data[1];
+		LL_ASSERT(hdr_flags.adv_addr);
+
+		return &com_hdr->ext_hdr_adv_data[1];
 	}
 #endif
 

subsys/bluetooth/controller/ll_sw/ull_adv_aux.c

@@ -477,7 +477,11 @@ uint8_t ull_adv_aux_hdr_set_clear(struct ll_adv_set *adv,
 
 	pri_com_hdr_prev = (void *)&pri_pdu_prev->adv_ext_ind;
 	pri_hdr = (void *)pri_com_hdr_prev->ext_hdr_adv_data;
-	pri_hdr_prev = *pri_hdr;
+	if (pri_com_hdr_prev->ext_hdr_len) {
+		pri_hdr_prev = *pri_hdr;
+	} else {
+		*(uint8_t *)&pri_hdr_prev = 0U;
+	}
 	pri_dptr_prev = pri_hdr->data;
 
 	/* Advertising data are not supported by scannable instances */
@@ -701,6 +705,11 @@ uint8_t ull_adv_aux_hdr_set_clear(struct ll_adv_set *adv,
 	/* Fill AdvData in secondary PDU */
 	memmove(sec_dptr, ad_data, ad_len);
 
+	/* Early exit if no flags set */
+	if (!sec_com_hdr->ext_hdr_len) {
+		return 0;
+	}
+
 	/* No ACAD in primary channel PDU */
 	/* TODO: Fill ACAD in secondary channel PDU */