From: Pauli Virtanen <noreply@github.com>
To: linux-bluetooth@vger.kernel.org
Subject: [bluez/bluez] c53a16: emulator: bthost: don't crash on ecred_conn_req wi...
Date: Mon, 31 Aug 2026 13:45:20 -0700 [thread overview]
Message-ID: <bluez/bluez/push/refs/heads/master/e81413-3a2d54@github.com> (raw)
Branch: refs/heads/master
Home: https://github.com/bluez/bluez
Commit: c53a16afa33dc1afc0b1c5540191a563c4b4a8ec
https://github.com/bluez/bluez/commit/c53a16afa33dc1afc0b1c5540191a563c4b4a8ec
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M emulator/bthost.c
Log Message:
-----------
emulator: bthost: don't crash on ecred_conn_req with too many scid
l2cap_ecred_conn_req() crashes if the request contains more SCID than
specification allows (5).
Respond 0x000C - All connections refused – invalid parameters to such
invalid requests.
Commit: 0b66bd5335d068e4ec11333a36768fc7f4e9f871
https://github.com/bluez/bluez/commit/0b66bd5335d068e4ec11333a36768fc7f4e9f871
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M tools/l2cap-tester.c
Log Message:
-----------
tools/l2cap-tester: add test for too many ECRED deferred sockets
Add test tries to trigger connection with 5+1 ECRED channels, and
require the last connect() shall fail with -EPROTO. On some kernels
this causes invalid ECRED REQ be sent with 6 SCID, and stack overwrite.
L2CAP Ext-Flowctl Client - Defer limit
Commit: d52d9a173a5fd0bec9e38bbfba29da622792a1b9
https://github.com/bluez/bluez/commit/d52d9a173a5fd0bec9e38bbfba29da622792a1b9
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M emulator/bthost.c
M emulator/bthost.h
Log Message:
-----------
emulator: bthost: add function for sending raw L2CAP sig commands
Add bthost_l2cap_sig_raw() that tests can use to send raw L2CAP
signaling commands.
Commit: 3a2d543c4c21d9c1dab246d46d76a11996a69bf2
https://github.com/bluez/bluez/commit/3a2d543c4c21d9c1dab246d46d76a11996a69bf2
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M tools/l2cap-tester.c
Log Message:
-----------
tools/l2cap-server: add test for invalid Conn Req on Ext-Flowctl server
Add test that checks Ext-Flowctl server handles invalid connection
requests with ident collisions. This triggers null-deref crash / hang on
some kernel versions.
L2CAP Ext-Flowctl Server - Nval Conn Req
Compare: https://github.com/bluez/bluez/compare/e8141342284b...3a2d543c4c21
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
reply other threads:[~2026-08-31 20:45 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bluez/bluez/push/refs/heads/master/e81413-3a2d54@github.com \
--to=noreply@github.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.