[PATCH] Bluetooth: L2CAP: Fix size check for receive buffer space

[PATCH] Bluetooth: L2CAP: Fix size check for receive buffer space

[Amir Abudubai]

Check that available receive space covers a full MTU-sized SDU and its
overhead, rather than just the overhead. Otherwise, credits can be
exhausted before an SDU is completed. This could result in a deadlock under
some configurations and SDU combinations.

This follows the SDU-sized credit policy from commit 96cd8eaa131f
("Bluetooth: L2CAP: Derive rx credits from MTU and MPS"). Clarify the
comment by replacing "packet" with "SDU".

Fixes: ce60b9231b66 ("Bluetooth: compute LE flow credits based on recvbuf space")
Signed-off-by: Amir Abudubai <amirabudubai@gmail.com>
---
The exact SDU length that causes a deadlock depends on build and configuration.
On my machine, 13090-byte SDUs caused deadlocks and this patch fixed it.

AI assistance: OpenCode/GPT-6 Astra for testing and analysis.

 net/bluetooth/l2cap_sock.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 7a2551ef7f50..8603e63defb5 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1229,11 +1229,11 @@ static void l2cap_publish_rx_avail(struct l2cap_chan *chan)
 
 	/* Correct available memory by estimated sk_buff overhead.
 	 * This is significant due to small transfer sizes. However, accept
-	 * at least one full packet if receive space is non-zero.
+	 * at least one full SDU if receive space is non-zero.
 	 */
 	expected_skbs = DIV_ROUND_UP(avail, chan->mps);
 	skb_overhead = expected_skbs * sizeof(struct sk_buff);
-	if (skb_overhead < avail)
+	if (avail - skb_overhead >= chan->imtu + L2CAP_SDULEN_SIZE)
 		l2cap_chan_rx_avail(chan, avail - skb_overhead);
 	else
 		l2cap_chan_rx_avail(chan, -1);

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb

RE: Bluetooth: L2CAP: Fix size check for receive buffer space

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1074 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1208782/

---Test result---

Test Summary:
CheckPatch                    PASS      0.77 seconds
VerifyFixes                   PASS      0.82 seconds
VerifySignedoff               PASS      0.51 seconds
GitLint                       PASS      2.18 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      23.41 seconds
CheckAllWarning               PASS      27.15 seconds
CheckSparse                   PASS      36.28 seconds
BuildKernel32                 PASS      24.00 seconds
CheckKernelLLVM               PASS      24.70 seconds
TestRunnerSetup               PASS      554.55 seconds
TestRunner_l2cap-tester       PASS      13.20 seconds
IncrementalBuild              PASS      22.87 seconds



https://github.com/bluez/bluetooth-next/pull/1116

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: L2CAP: Fix size check for receive buffer space

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed, 11 Nov 2026 15:49:05 -0600 you wrote:
> Check that available receive space covers a full MTU-sized SDU and its
> overhead, rather than just the overhead. Otherwise, credits can be
> exhausted before an SDU is completed. This could result in a deadlock under
> some configurations and SDU combinations.
> 
> This follows the SDU-sized credit policy from commit 96cd8eaa131f
> ("Bluetooth: L2CAP: Derive rx credits from MTU and MPS"). Clarify the
> comment by replacing "packet" with "SDU".
> 
> [...]

Here is the summary with links:
  - Bluetooth: L2CAP: Fix size check for receive buffer space
    https://git.kernel.org/bluetooth/bluetooth-next/c/3b069de8a5d6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html