Re: [PATCH v2] Bluetooth: L2CAP: CoC: Disconnect if received packet size exceeds MPS

[Christian Eggers <ceggers@arri.de>]

On Thursday, 26 February 2026, 21:43:57 CET, Luiz Augusto von Dentz wrote:
> From: Christian Eggers <ceggers@arri.de>
> 
> Core 6.0, Vol 3, Part A, 3.4.3:
> "... If the payload size of any K-frame exceeds the receiver's MPS, the
> receiver shall disconnect the channel..."
> 
> This fixes L2CAP/LE/CFC/BV-27-C (running together with 'l2test -r -P
> 0x0027 -V le_public -I 100').
> 
> Signed-off-by: Christian Eggers <ceggers@arri.de>
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
> Note: due to lack of L2CAP CoC segmentation support in bthost the following
> test as expected to fail:
> 
> L2CAP LE Client - Read 32k Success
> L2CAP LE Client - RX Timestamping 32k
> 
>  net/bluetooth/l2cap_core.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index f550ceceb618..14131e427efd 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -6669,6 +6669,13 @@ static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
>  		return -ENOBUFS;
>  	}
>  
> +	if (skb->len > chan->mps) {
> +		BT_ERR("Too big LE L2CAP MPS: len %u > %u", skb->len,
> +		       chan->mps);
> +		l2cap_send_disconn_req(chan, ECONNRESET);
> +		return -ENOBUFS;
> +	}
> +
>  	chan->rx_credits--;
>  	BT_DBG("chan %p: rx_credits %u -> %u",
>  	       chan, chan->rx_credits + 1, chan->rx_credits);
> 

Tested-by: Christian Eggers <ceggers@arri.de>