[PATCH v10 1/2] Bluetooth: L2CAP: Restrict LE credits to connected CoCs

[Kyle Pepper <cochcoder@proton.me>]

Do not let credit indications change fixed channels or complete pending
connection setup. Validate the channel state and mode before accounting
credits, checking overflow or invoking its resume callback.

Fixes: fad5fc89594d ("Bluetooth: Add LE flow control discipline")
Assisted-by: LLM
Signed-off-by: Kyle Pepper <cochcoder@proton.me>
---
Hi Luiz,

I split the credit validation into its own patch and reworked the security
handling to use the existing HCI workqueue. There is no new workqueue or
pairing timeout. The original l2cap-tester and smp-tester now pass without
changing their expectations.

I also checked failure handling, repeated security
requests, key refresh and deferred LE/ECRED setup so fixing that bypass
doesn't leave sockets stuck.

Hopefully this brings the patch to a more usable state.

Thanks,
Kyle

v10:
- Separate malformed-credit validation from security request completion.
- Use the existing HCI workqueue and SMP/HCI timeouts.
- Keep pending upgrades gated through failure, refresh and deferred setup.

Previous v9: https://lore.kernel.org/linux-bluetooth/20261112022948.187618-1-cochcoder@proton.me/
Threading uses the Message-ID from sent mail; the archive lookup is not yet
available. Luiz's reply Message-ID was not supplied.

Validation: original l2cap-tester 111/111 and smp-tester 8/8; 27 private native
cases; GCC/Clang/ECRED-off W=1 builds; 42 modeled cases per compiler with
ASan/UBSan and 10 expected mutation failures. Guest tests use emulated
controllers and checked module identities. Physical hardware, PTS, KCSAN
and remote CI were not run. Private fixtures and traces are not included.

 net/bluetooth/l2cap_core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 09ff32394..4e8aec98e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5464,6 +5464,11 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
 
 	l2cap_chan_lock(chan);
 
+	if (chan->state != BT_CONNECTED ||
+	    (chan->mode != L2CAP_MODE_LE_FLOWCTL &&
+	     chan->mode != L2CAP_MODE_EXT_FLOWCTL))
+		goto unlock;
+
 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
 	if (credits > max_credits) {
 		BT_ERR("LE credits overflow");

base-commit: da3cc02587c629420603df4395179ec82955c941