* [PATCH v2] Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
@ 2026-02-04 21:44 Luiz Augusto von Dentz
2026-02-04 22:42 ` [v2] " bluez.test.bot
0 siblings, 1 reply; 2+ messages in thread
From: Luiz Augusto von Dentz @ 2026-02-04 21:44 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This fixes responding with an invalid result caused by checking the
wrong size of CID which should have been (cmd_len - sizeof(*req)) and
on top of it the wrong result was use L2CAP_CR_LE_INVALID_PARAMS which
is invalid/reserved for reconf when running test like L2CAP/ECFC/BI-03-C:
> ACL Data RX: Handle 64 flags 0x02 dlen 14
LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 2 len 6
MTU: 64
MPS: 64
Source CID: 64
< ACL Data TX: Handle 64 flags 0x00 dlen 10
LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2
! Result: Reserved (0x000c)
Result: Reconfiguration failed - one or more Destination CIDs invalid (0x0003)
Fiix L2CAP/ECFC/BI-04-C which expects L2CAP_RECONF_INVALID_MPS (0x0002)
when more than one channel gets its MPS reduced:
> ACL Data RX: Handle 64 flags 0x02 dlen 16
LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 2 len 8
MTU: 264
MPS: 99
Source CID: 64
! Source CID: 65
< ACL Data TX: Handle 64 flags 0x00 dlen 10
LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2
! Result: Reconfiguration successful (0x0000)
Result: Reconfiguration failed - reduction in size of MPS not allowed for more than one channel at a time (0x0002)
Fix L2CAP/ECFC/BI-05-C when SCID is invalid (85 unconnected):
> ACL Data RX: Handle 64 flags 0x02 dlen 14
LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 2 len 6
MTU: 65
MPS: 64
! Source CID: 85
< ACL Data TX: Handle 64 flags 0x00 dlen 10
LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2
! Result: Reconfiguration successful (0x0000)
Result: Reconfiguration failed - one or more Destination CIDs invalid (0x0003)
Fix L2CAP/ECFC/BI-06-C when MPS < L2CAP_ECRED_MIN_MPS (64):
> ACL Data RX: Handle 64 flags 0x02 dlen 14
LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 2 len 6
MTU: 672
! MPS: 63
Source CID: 64
< ACL Data TX: Handle 64 flags 0x00 dlen 10
LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2
! Result: Reconfiguration failed - reduction in size of MPS not allowed for more than one channel at a time (0x0002)
Result: Reconfiguration failed - other unacceptable parameters (0x0004)
Fix L2CAP/ECFC/BI-07-C when MPS reduced for more than one channel:
> ACL Data RX: Handle 64 flags 0x02 dlen 16
LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 3 len 8
MTU: 84
! MPS: 71
Source CID: 64
! Source CID: 65
< ACL Data TX: Handle 64 flags 0x00 dlen 10
LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2
! Result: Reconfiguration successful (0x0000)
Result: Reconfiguration failed - reduction in size of MPS not allowed for more than one channel at a time (0x0002)
Link: https://github.com/bluez/bluez/issues/1865
Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
include/net/bluetooth/l2cap.h | 2 +
net/bluetooth/l2cap_core.c | 71 ++++++++++++++++++++++++-----------
2 files changed, 51 insertions(+), 22 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index ec3af01e4db9..6f9cf7a05986 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -493,6 +493,8 @@ struct l2cap_ecred_reconf_req {
#define L2CAP_RECONF_SUCCESS 0x0000
#define L2CAP_RECONF_INVALID_MTU 0x0001
#define L2CAP_RECONF_INVALID_MPS 0x0002
+#define L2CAP_RECONF_INVALID_CID 0x0003
+#define L2CAP_RECONF_INVALID_PARAMS 0x0004
struct l2cap_ecred_reconf_rsp {
__le16 result;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b628b0fa39b2..119bbfcb8ff1 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5310,14 +5310,14 @@ static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn,
struct l2cap_ecred_reconf_req *req = (void *) data;
struct l2cap_ecred_reconf_rsp rsp;
u16 mtu, mps, result;
- struct l2cap_chan *chan;
+ struct l2cap_chan *chan[L2CAP_ECRED_MAX_CID] = {};
int i, num_scid;
if (!enable_ecred)
return -EINVAL;
- if (cmd_len < sizeof(*req) || cmd_len - sizeof(*req) % sizeof(u16)) {
- result = L2CAP_CR_LE_INVALID_PARAMS;
+ if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) {
+ result = L2CAP_RECONF_INVALID_CID;
goto respond;
}
@@ -5327,42 +5327,69 @@ static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn,
BT_DBG("mtu %u mps %u", mtu, mps);
if (mtu < L2CAP_ECRED_MIN_MTU) {
- result = L2CAP_RECONF_INVALID_MTU;
+ result = L2CAP_RECONF_INVALID_PARAMS;
goto respond;
}
if (mps < L2CAP_ECRED_MIN_MPS) {
- result = L2CAP_RECONF_INVALID_MPS;
+ result = L2CAP_RECONF_INVALID_PARAMS;
goto respond;
}
cmd_len -= sizeof(*req);
num_scid = cmd_len / sizeof(u16);
+
+ if (num_scid > L2CAP_ECRED_MAX_CID) {
+ result = L2CAP_RECONF_INVALID_PARAMS;
+ goto respond;
+ }
+
result = L2CAP_RECONF_SUCCESS;
+ /* Check if each SCID, MTU and MPS are valid */
for (i = 0; i < num_scid; i++) {
u16 scid;
scid = __le16_to_cpu(req->scid[i]);
- if (!scid)
- return -EPROTO;
-
- chan = __l2cap_get_chan_by_dcid(conn, scid);
- if (!chan)
- continue;
-
- /* If the MTU value is decreased for any of the included
- * channels, then the receiver shall disconnect all
- * included channels.
- */
- if (chan->omtu > mtu) {
- BT_ERR("chan %p decreased MTU %u -> %u", chan,
- chan->omtu, mtu);
- result = L2CAP_RECONF_INVALID_MTU;
+ if (!scid) {
+ result = L2CAP_RECONF_INVALID_CID;
+ goto respond;
}
- chan->omtu = mtu;
- chan->remote_mps = mps;
+ chan[i] = __l2cap_get_chan_by_dcid(conn, scid);
+ if (!chan[i]) {
+ result = L2CAP_RECONF_INVALID_CID;
+ goto respond;
+ }
+
+ /* The MTU field shall be greater than or equal to the greatest
+ * current MTU size of these channels.
+ */
+ if (chan[i]->omtu >= mtu) {
+ BT_ERR("chan %p decreased MTU %u -> %u", chan[i],
+ chan[i]->omtu, mtu);
+ result = L2CAP_RECONF_INVALID_MTU;
+ goto respond;
+ }
+
+ /* If more than one channel is being configured, the MPS field
+ * shall be greater than or equal to the current MPS size of
+ * each of these channels. If only one channel is being
+ * configured, the MPS field may be less than the current MPS
+ * of that channel.
+ */
+ if (chan[i]->remote_mps >= mps && i) {
+ BT_ERR("chan %p decreased MPS %u -> %u", chan[i],
+ chan[i]->remote_mps, mps);
+ result = L2CAP_RECONF_INVALID_MPS;
+ goto respond;
+ }
+ }
+
+ /* Commit the new MTU and MPS values after checking they are valid */
+ for (i = 0; i < num_scid; i++) {
+ chan[i]->omtu = mtu;
+ chan[i]->remote_mps = mps;
}
respond:
--
2.52.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* RE: [v2] Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
2026-02-04 21:44 [PATCH v2] Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ Luiz Augusto von Dentz
@ 2026-02-04 22:42 ` bluez.test.bot
0 siblings, 0 replies; 2+ messages in thread
From: bluez.test.bot @ 2026-02-04 22:42 UTC (permalink / raw)
To: linux-bluetooth, luiz.dentz
[-- Attachment #1: Type: text/plain, Size: 3201 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1050911
---Test result---
Test Summary:
CheckPatch PENDING 0.33 seconds
GitLint PENDING 0.29 seconds
SubjectPrefix PASS 0.11 seconds
BuildKernel PASS 25.59 seconds
CheckAllWarning PASS 28.46 seconds
CheckSparse WARNING 31.81 seconds
BuildKernel32 PASS 24.96 seconds
TestRunnerSetup PASS 558.85 seconds
TestRunner_l2cap-tester PASS 28.09 seconds
TestRunner_iso-tester FAIL 51.30 seconds
TestRunner_bnep-tester PASS 6.32 seconds
TestRunner_mgmt-tester FAIL 115.64 seconds
TestRunner_rfcomm-tester PASS 9.42 seconds
TestRunner_sco-tester FAIL 14.52 seconds
TestRunner_ioctl-tester PASS 10.28 seconds
TestRunner_mesh-tester FAIL 15.89 seconds
TestRunner_smp-tester PASS 8.73 seconds
TestRunner_userchan-tester PASS 6.75 seconds
IncrementalBuild PENDING 0.66 seconds
Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:
##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:
##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
net/bluetooth/l2cap_core.c:7762:1: error: bad constant expressionnet/bluetooth/l2cap_core.c:7763:1: error: bad constant expressionnet/bluetooth/l2cap_core.c:7765:1: error: bad constant expressionnet/bluetooth/l2cap_core.c:7766:1: error: bad constant expression
##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
BUG: KASAN: slab-use-after-free in le_read_features_complete+0x7e/0x2b0
Total: 141, Passed: 141 (100.0%), Failed: 0, Not Run: 0
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 494, Passed: 489 (99.0%), Failed: 1, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.100 seconds
##############################
Test: TestRunner_sco-tester - FAIL
Desc: Run sco-tester with test-runner
Output:
WARNING: possible circular locking dependency detected
BUG: sleeping function called from invalid context at net/core/sock.c:3782
Total: 30, Passed: 30 (100.0%), Failed: 0, Not Run: 0
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Timed out 2.715 seconds
Mesh - Send cancel - 2 Timed out 1.998 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-02-04 22:42 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-04 21:44 [PATCH v2] Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ Luiz Augusto von Dentz
2026-02-04 22:42 ` [v2] " bluez.test.bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox