[PATCH BlueZ 1/2] emulator: bthost: don't crash on ecred_conn_req with too many scid

[PATCH BlueZ 1/2] emulator: bthost: don't crash on ecred_conn_req with too many scid

[Pauli Virtanen]

l2cap_ecred_conn_req() crashes if the request contains more SCID than
specification allows (5).

Respond 0x000C - All connections refused – invalid parameters to such
invalid requests.
---
 emulator/bthost.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/emulator/bthost.c b/emulator/bthost.c
index 46c6a52f5..d23b709ea 100644
--- a/emulator/bthost.c
+++ b/emulator/bthost.c
@@ -2607,6 +2607,13 @@ static bool l2cap_ecred_conn_req(struct bthost *bthost, struct btconn *conn,
 	len -= sizeof(rsp.pdu);
 	num_scid = len / sizeof(*req->scid);
 
+	if (num_scid > (int)ARRAY_SIZE(rsp.dcid)) {
+		rsp.pdu.result = cpu_to_le16(0x000c); /* Refuse all - Invalid */
+		bthost_debug(bthost, "invalid ECRED_CONN_REQ (num_scid = %d)",
+								num_scid);
+		goto respond;
+	}
+
 	for (; i < num_scid; i++)
 		rsp.dcid[i] = cpu_to_le16(conn->next_cid++);
 
-- 
2.55.0

[PATCH BlueZ 2/2] tools/l2cap-tester: add test for too many ECRED deferred sockets

[Pauli Virtanen]

Add test tries to trigger connection with 5+1 ECRED channels, and
require the last connect() shall fail with -EPROTO.  On some kernels
this causes invalid ECRED REQ be sent with 6 SCID, and stack overwrite.

L2CAP Ext-Flowctl Client - Defer limit
---

Notes:
    Passing this test requires the kernel patch
    
    "Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect"

 tools/l2cap-tester.c | 97 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 97 insertions(+)

diff --git a/tools/l2cap-tester.c b/tools/l2cap-tester.c
index 69c529aa8..4bbbe58dd 100644
--- a/tools/l2cap-tester.c
+++ b/tools/l2cap-tester.c
@@ -1389,6 +1389,12 @@ static const struct l2cap_data ext_flowctl_client_set_phy_coded_test = {
 	.phy = BT_PHY_LE_CODED_TX | BT_PHY_LE_CODED_RX,
 };
 
+static const struct l2cap_data ext_flowctl_client_defer_limit = {
+	.client_psm = 0x0080,
+	.server_psm = 0x0080,
+	.mode = BT_MODE_EXT_FLOWCTL,
+};
+
 static void client_cmd_complete(uint16_t opcode, uint8_t status,
 					const void *param, uint8_t len,
 					void *user_data)
@@ -2890,6 +2896,92 @@ static void test_connect_2(const void *test_data)
 								defer);
 }
 
+static gboolean watch_no_track_cb(GIOChannel *io, GIOCondition cond,
+							gpointer user_data)
+{
+	int sk = g_io_channel_unix_get_fd(io);
+
+	tester_print("Ready sk = %d", sk);
+	return FALSE;
+}
+
+static int watch_and_close_sk(int sk)
+{
+	GIOChannel *io;
+
+	if (sk < 0)
+		return sk;
+
+	io = g_io_channel_unix_new(sk);
+	g_io_add_watch(io, G_IO_OUT | G_IO_ERR | G_IO_HUP | G_IO_NVAL,
+						watch_no_track_cb, NULL);
+	g_io_channel_unref(io);
+
+	return sk;
+}
+
+static void test_connect_ext_defer_limit(const void *test_data)
+{
+	struct test_data *data = tester_get_data();
+	const struct l2cap_data *l2data = data->test_data;
+	const uint8_t *client_bdaddr;
+	int sk[6];
+	int err;
+	int opt = 1;
+	int i;
+
+	data->step = 6;
+
+	if (l2data->server_psm) {
+		struct bthost *bthost = hciemu_client_get_host(data->hciemu);
+
+		if (!l2data->data_len)
+			bthost_add_l2cap_server(bthost, l2data->server_psm,
+						NULL, NULL, NULL);
+	}
+
+	client_bdaddr = hciemu_get_client_bdaddr(data->hciemu);
+
+	/* Close sk only after connection, to trigger kernel processing */
+	sk[0] = watch_and_close_sk(connect_socket(client_bdaddr, NULL, true));
+	sk[1] = watch_and_close_sk(connect_socket(client_bdaddr, NULL, true));
+	sk[2] = watch_and_close_sk(connect_socket(client_bdaddr, NULL, true));
+	sk[3] = watch_and_close_sk(connect_socket(client_bdaddr, NULL, true));
+	sk[4] = watch_and_close_sk(connect_socket(client_bdaddr, NULL, false));
+
+	/* Open one deferred socket too many for ECRED REQ, triggers miscounting
+	 * of pending connections in some kernel versions.
+	 */
+	sk[5] = create_l2cap_sock(data, 0, l2data->cid, l2data->sec_level,
+								l2data->mode);
+	if (sk[5] < 0) {
+		tester_test_failed();
+		return;
+	}
+
+	if (setsockopt(sk[5], SOL_BLUETOOTH, BT_DEFER_SETUP, &opt,
+							sizeof(opt)) < 0) {
+		tester_test_failed();
+		close(sk[5]);
+		return;
+	}
+
+	err = connect_l2cap_impl(sk[5], client_bdaddr, BDADDR_LE_PUBLIC,
+					l2data->client_psm, l2data->cid);
+	if (err == -EPROTO) {
+		tester_test_passed();
+
+		for (i = 0; i < (int)ARRAY_SIZE(sk); ++i)
+			if (sk[i] >= 0)
+				close(sk[i]);
+	} else {
+		/* Try to trigger kernel to make ECRED REQ with > 5 SCID */
+		watch_and_close_sk(sk[5]);
+
+		tester_test_failed();
+	}
+}
+
 static gboolean l2cap_accept_cb(GIOChannel *io, GIOCondition cond,
 							gpointer user_data)
 {
@@ -3528,6 +3620,11 @@ int main(int argc, char *argv[])
 				&ext_flowctl_client_set_phy_coded_test,
 				setup_powered_client, test_connect);
 
+	test_l2cap_le("L2CAP Ext-Flowctl Client - Defer limit",
+				&ext_flowctl_client_defer_limit,
+				setup_powered_client,
+				test_connect_ext_defer_limit);
+
 	test_l2cap_le("L2CAP Ext-Flowctl Server - Success",
 				&ext_flowctl_server_success_test,
 				setup_powered_server, test_server);
-- 
2.55.0

RE: [BlueZ,1/2] emulator: bthost: don't crash on ecred_conn_req with too many scid

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1459 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1153725

---Test result---

Test Summary:
CheckPatch                    PASS      0.85 seconds
GitLint                       FAIL      0.53 seconds
BuildEll                      PASS      18.32 seconds
BluezMake                     PASS      631.34 seconds
CheckSmatch                   WARNING   272.55 seconds
bluezmakeextell               PASS      93.87 seconds
IncrementalBuild              PASS      654.04 seconds
ScanBuild                     PASS      871.76 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ,2/2] tools/l2cap-tester: add test for too many ECRED deferred sockets

12: B2 Line has trailing whitespace: "    "
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
emulator/bthost.c:703:28: warning: Variable length array is used.emulator/bthost.c:704:32: warning: Variable length array is used.emulator/bthost.c:944:28: warning: Variable length array is used.emulator/bthost.c:978:28: warning: Variable length array is used.emulator/bthost.c:979:32: warning: Variable length array is used.


https://github.com/bluez/bluez/pull/2455

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ 1/2] emulator: bthost: don't crash on ecred_conn_req with too many scid

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Sun, 30 Aug 2026 01:47:58 +0300 you wrote:
> l2cap_ecred_conn_req() crashes if the request contains more SCID than
> specification allows (5).
> 
> Respond 0x000C - All connections refused – invalid parameters to such
> invalid requests.
> ---
>  emulator/bthost.c | 7 +++++++
>  1 file changed, 7 insertions(+)

Here is the summary with links:
  - [BlueZ,1/2] emulator: bthost: don't crash on ecred_conn_req with too many scid
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=c53a16afa33d
  - [BlueZ,2/2] tools/l2cap-tester: add test for too many ECRED deferred sockets
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=0b66bd5335d0

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html