[PATCH v1] Bluetooth: L2CAP: Reject mode changes on connected channels

[PATCH v1] Bluetooth: L2CAP: Reject mode changes on connected channels

[Siwei Zhang]

Allowing mode changes on already-connected channel will
skip necessary initialization on the new mode, resulting
NULL ptr dereference.

Cc: stable@vger.kernel.org
Closes: https://sashiko.dev/#/patchset/20261007144717.3832330-1-oss%40fourdim.xyz
Fixes: f2fcfcd67025 ("Bluetooth: Add configuration support for ERTM and Streaming mode")
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
---
Please apply https://lore.kernel.org/linux-bluetooth/20261007144717.3832330-1-oss@fourdim.xyz/
as well, thank you.

 net/bluetooth/l2cap_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index cb4ec42f99e3..2cb3f59112f5 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3876,7 +3876,8 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
 		}
 	}
 
-	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
+	if ((chan->mode == L2CAP_MODE_BASIC || chan->state == BT_CONNECTED) &&
+	    chan->mode != rfc.mode)
 		return -ECONNREFUSED;
 
 	chan->mode = rfc.mode;
-- 
2.55.0

Re: [PATCH v1] Bluetooth: L2CAP: Reject mode changes on connected channels

[Siwei Zhang]

On Thu, Oct 8, 2026, at 10:17 AM, Siwei Zhang wrote:
> Allowing mode changes on already-connected channel will
> skip necessary initialization on the new mode, resulting
> NULL ptr dereference.
>
> Cc: stable@vger.kernel.org
> Closes: 
> https://sashiko.dev/#/patchset/20261007144717.3832330-1-oss%40fourdim.xyz
> Fixes: f2fcfcd67025 ("Bluetooth: Add configuration support for ERTM and 
> Streaming mode")
> Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
> ---
> Please apply 
> https://lore.kernel.org/linux-bluetooth/20261007144717.3832330-1-oss@fourdim.xyz/
> as well, thank you.

Hi all,

Please don't apply it for now.

There will be some more commits to add and be turning into a patch
series. This will be the first commit.

Thank you.

Best,
Siwei

>
>  net/bluetooth/l2cap_core.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index cb4ec42f99e3..2cb3f59112f5 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -3876,7 +3876,8 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan 
> *chan, void *rsp, int len,
>  		}
>  	}
> 
> -	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
> +	if ((chan->mode == L2CAP_MODE_BASIC || chan->state == BT_CONNECTED) &&
> +	    chan->mode != rfc.mode)
>  		return -ECONNREFUSED;
> 
>  	chan->mode = rfc.mode;
> -- 
> 2.55.0

RE: [v1] Bluetooth: L2CAP: Reject mode changes on connected channels

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1073 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1181680/

---Test result---

Test Summary:
CheckPatch                    PASS      0.73 seconds
VerifyFixes                   PASS      0.44 seconds
VerifySignedoff               PASS      0.13 seconds
GitLint                       PASS      0.32 seconds
SubjectPrefix                 PASS      0.12 seconds
BuildKernel                   PASS      29.10 seconds
CheckAllWarning               PASS      32.91 seconds
CheckSparse                   PASS      35.56 seconds
BuildKernel32                 PASS      28.89 seconds
CheckKernelLLVM               PASS      34.86 seconds
TestRunnerSetup               PASS      767.82 seconds
TestRunner_l2cap-tester       PASS      12.53 seconds
IncrementalBuild              PASS      27.63 seconds



https://github.com/bluez/bluetooth-next/pull/889

---
Regards,
Linux Bluetooth