diff --git a/subsys/bluetooth/controller/ll_sw/ull_adv_aux.c b/subsys/bluetooth/controller/ll_sw/ull_adv_aux.c index 37db8e8d081..675f549501a 100644 --- a/subsys/bluetooth/controller/ll_sw/ull_adv_aux.c +++ b/subsys/bluetooth/controller/ll_sw/ull_adv_aux.c @@ -194,13 +194,27 @@ uint8_t ll_adv_aux_sr_data_set(uint8_t handle, uint8_t op, uint8_t frag_pref, ui */ pri_pdu_prev = lll_adv_data_peek(lll); if (pri_pdu_prev->type != PDU_ADV_TYPE_EXT_IND) { + if ((op != BT_HCI_LE_EXT_ADV_OP_COMPLETE_DATA) || (len > 31)) { + return BT_HCI_ERR_INVALID_PARAM; + } return ull_scan_rsp_set(adv, len, data); } + /* Can only set complete data and cannot discard data on enabled set */ + if (adv->is_enabled && ((op != BT_HCI_LE_EXT_ADV_OP_COMPLETE_DATA) || + (len == 0))) { + return BT_HCI_ERR_CMD_DISALLOWED; + } + LL_ASSERT(lll->aux); aux_pdu = lll_adv_aux_data_peek(lll->aux); sr_prev = lll_adv_scan_rsp_peek(lll); + /* Can only discard data on non-scannable instances */ + if (!(aux_pdu->adv_ext_ind.adv_mode & BT_HCI_LE_ADV_PROP_SCAN) && len) { + return BT_HCI_ERR_INVALID_PARAM; + } + /* Update scan response PDU fields. */ sr_pdu = lll_adv_scan_rsp_alloc(lll, &idx); sr_pdu->type = PDU_ADV_TYPE_AUX_SCAN_RSP;