Re: [PATCH v2] Bluetooth: L2CAP: CoC: Disconnect if received packet size exceeds MPS

[Christian Eggers <ceggers@arri.de>]

Hi Luiz,

On Thursday, 26 February 2026, 21:48:48 CET, Luiz Augusto von Dentz wrote:
> Hi Christian,
> 
> On Thu, Feb 26, 2026 at 3:44 PM Luiz Augusto von Dentz
> <luiz.dentz@gmail.com> wrote:
> >
> > From: Christian Eggers <ceggers@arri.de>
> >
> > Core 6.0, Vol 3, Part A, 3.4.3:
> > "... If the payload size of any K-frame exceeds the receiver's MPS, the
> > receiver shall disconnect the channel..."
> >
> > This fixes L2CAP/LE/CFC/BV-27-C (running together with 'l2test -r -P
> > 0x0027 -V le_public -I 100').
> >
> > Signed-off-by: Christian Eggers <ceggers@arri.de>
> > Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > ---
> > Note: due to lack of L2CAP CoC segmentation support in bthost the following
> > test as expected to fail:
> >
> > L2CAP LE Client - Read 32k Success
> > L2CAP LE Client - RX Timestamping 32k
> 
> I didn't have to introduce any new fields btw since the above tests
> confirm the MPS is working. I reverted to just using chan->mps, remote
> mps is tracked by remote_mps field and I check that the remote cannot
> actually set our own MPS. I wonder if something else was at play or if
> there is some specific requirement for L2CAP/LE/CFC/BV-27-C (e.g.
> reconfigure?)

Unfortunately I cannot tell anymore why simply checking chan->mps was not
sufficient for me. I have tested your simplified version and 
L2CAP/LE/CFC/BV-27-C runs fine. So you can add this to bluetooth-next.

BTW: In the description of the other patch 
"LE L2CAP: Disconnect if sum of payload sizes exceed SDU", the PTS test
seem to be wrong:

L2CAP/LE/CFC/BV-27-C --> L2CAP/LE/CFC/BV-28-C

Maybe you would like to fix this in bluetooth-next

regards,
Christian

> 
> >
> >  net/bluetooth/l2cap_core.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> >
> > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> > index f550ceceb618..14131e427efd 100644
> > --- a/net/bluetooth/l2cap_core.c
> > +++ b/net/bluetooth/l2cap_core.c
> > @@ -6669,6 +6669,13 @@ static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
> >                 return -ENOBUFS;
> >         }
> >
> > +       if (skb->len > chan->mps) {
> > +               BT_ERR("Too big LE L2CAP MPS: len %u > %u", skb->len,
> > +                      chan->mps);
> > +               l2cap_send_disconn_req(chan, ECONNRESET);
> > +               return -ENOBUFS;
> > +       }
> > +
> >         chan->rx_credits--;
> >         BT_DBG("chan %p: rx_credits %u -> %u",
> >                chan, chan->rx_credits + 1, chan->rx_credits);
> > --
> > 2.52.0
> >
> 
> 
>