[RFC PATCH] l2cap-tester: Check deferred ECRED batch rejection

[Kyle Pepper <cochcoder@proton.me>]

Closing an accepted child while its ECRED response is deferred rejects
the pending batch with the L2CAP security changes. Check the peer's
authorization response and both zero DCIDs instead of waiting to accept
a sibling that has been closed.

Expect five zero DCIDs when rejecting the five-channel EATT request.
Also check accept()'s return value before reading the child socket.

Assisted-by: Codex:GPT-6
---
Depends on the deferred ECRED batch handling in kernel RFC v8 patch 1:
https://github.com/bluez/bluetooth-next/pull/1084

Local native L2CAP: original 109/111, repaired 111/111; unchanged base
111/111. BlueZ unit suite: 35/35. Both failing CI cases reproduce.
Required attribution remains; raw checkpatch rejects its trailer.

 tools/l2cap-tester.c | 39 +++++++++++++++++++++++++++++----------
 1 file changed, 29 insertions(+), 10 deletions(-)

diff --git a/tools/l2cap-tester.c b/tools/l2cap-tester.c
index 4002ca561..84f8c2e26 100644
--- a/tools/l2cap-tester.c
+++ b/tools/l2cap-tester.c
@@ -1164,13 +1164,25 @@ static const uint8_t ecred_connect_req_2[] = {
 						0x42, 0x00, /* SCID #2 */
 };
 
+static const uint8_t ecred_reject_rsp_2[] = {
+	0xa0, 0x02, /* MTU */
+	0xbc, 0x00, /* MPS */
+	0x04, 0x00, /* Credits */
+	0x06, 0x00, /* Result: insufficient authorization */
+	0x00, 0x00, /* DCID #1 */
+	0x00, 0x00, /* DCID #2 */
+};
+
 static const struct l2cap_data ext_flowctl_server_accept_2_close_1_test = {
 	.server_psm = 0x0080,
 	.defer = true,
 	.mode = BT_MODE_EXT_FLOWCTL,
 	.send_cmd_code = BT_L2CAP_PDU_ECRED_CONN_REQ,
 	.send_cmd = ecred_connect_req_2,
-	.send_cmd_len = ARRAY_SIZE(ecred_connect_req_2)
+	.send_cmd_len = ARRAY_SIZE(ecred_connect_req_2),
+	.expect_cmd_code = BT_L2CAP_PDU_ECRED_CONN_RSP,
+	.expect_cmd = ecred_reject_rsp_2,
+	.expect_cmd_len = sizeof(ecred_reject_rsp_2),
 };
 
 static const struct l2cap_data ext_flowctl_server_phy_test = {
@@ -1310,6 +1322,11 @@ static const uint8_t eatt_reject_rsp[] = {	0xa0, 0x02, /* MTU */
 						0xbc, 0x00, /* MPS */
 						0x04, 0x00, /* Credits */
 						0x06, 0x00, /* Result */
+						0x00, 0x00, /* DCID #1 */
+						0x00, 0x00, /* DCID #2 */
+						0x00, 0x00, /* DCID #3 */
+						0x00, 0x00, /* DCID #4 */
+						0x00, 0x00, /* DCID #5 */
 };
 
 static const struct l2cap_data le_eatt_server_reject_test_1 = {
@@ -3331,12 +3348,12 @@ static bool ext_flowctl_accept_2_close_1_listen_cb(struct tester_io *io,
 {
 	struct test_data *data = tester_get_data();
 	int sk, new_sk;
-	int err = 0;
+	struct pollfd pfd;
 
 	sk = tester_io_get_fd(io);
 
 	new_sk = accept(sk, NULL, NULL);
-	if (err < 0) {
+	if (new_sk < 0) {
 		tester_warn("accept failed: %s (%u)", strerror(errno), errno);
 		tester_test_failed();
 		return false;
@@ -3347,11 +3364,16 @@ static bool ext_flowctl_accept_2_close_1_listen_cb(struct tester_io *io,
 
 	close(new_sk);
 
-	if (data->step--)
-		return true;
+	memset(&pfd, 0, sizeof(pfd));
+	pfd.fd = sk;
+	pfd.events = POLLIN;
 
-	tester_test_passed();
+	if (poll(&pfd, 1, 0) != 0) {
+		tester_warn("Rejected batch left an acceptable sibling");
+		tester_test_failed();
+	}
 
+	/* The peer callback checks the rejection response for both channels. */
 	data->io_id = 0;
 	return false;
 
@@ -3363,9 +3385,6 @@ fail:
 
 static void test_ext_flowctl_server_accept_2_close_1(const void *test_data)
 {
-	struct test_data *data = tester_get_data();
-
-	data->step = 1;
 	start_test_server(test_data, send_req_new_conn,
 					ext_flowctl_accept_2_close_1_listen_cb);
 }
@@ -3864,7 +3883,7 @@ int main(int argc, char *argv[])
 	test_l2cap_le("L2CAP Ext-Flowctl Server - Nval SCID",
 				&ext_flowctl_server_nval_scid_test,
 				setup_powered_server, test_server);
-	test_l2cap_le("L2CAP Ext-Flowctl Server - Accept 2 Close 1",
+	test_l2cap_le("L2CAP Ext-Flowctl Server - Close rejects deferred batch",
 				&ext_flowctl_server_accept_2_close_1_test,
 				setup_powered_server,
 				test_ext_flowctl_server_accept_2_close_1);
-- 
2.56.0