[PATCH v1] Bluetooth: L2CAP: Ignore connection responses with wrong ident

[PATCH v1] Bluetooth: L2CAP: Ignore connection responses with wrong ident

[Jinwang Li]

L2CAP/COS/CED/BI-28-C requires the IUT to ignore a Connection Response
that carries an invalid Identifier.

l2cap_connect_create_rsp() only checks that a connection request is
outstanding, not that the response answers it. Add an ident check
against the pending request so that a mismatched response is dropped.

Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
---
 net/bluetooth/l2cap_core.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 83b622a42811..70ad30b091e4 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4480,11 +4480,11 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
 
 	lockdep_assert_held(&chan->conn->lock);
 
-	/* Only accept a response to a connection request we sent and that
-	 * is still outstanding. A channel waiting in BT_CONNECT for security
-	 * or the feature mask has not sent one yet.
+	/* Only accept a response matching a connection request we sent and
+	 * that is still outstanding. A channel waiting in BT_CONNECT for
+	 * security or the feature mask has not sent one yet.
 	 */
-	if (!l2cap_chan_connect_pending(chan))
+	if (!l2cap_chan_connect_pending(chan) || chan->ident != cmd->ident)
 		goto done;
 
 	switch (result) {
-- 
2.34.1

RE: [v1] Bluetooth: L2CAP: Ignore connection responses with wrong ident

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1074 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1196120/

---Test result---

Test Summary:
CheckPatch                    PASS      0.54 seconds
VerifyFixes                   PASS      0.09 seconds
VerifySignedoff               PASS      0.08 seconds
GitLint                       PASS      1.52 seconds
SubjectPrefix                 PASS      0.08 seconds
BuildKernel                   PASS      24.48 seconds
CheckAllWarning               PASS      28.59 seconds
CheckSparse                   PASS      30.97 seconds
BuildKernel32                 PASS      24.99 seconds
CheckKernelLLVM               PASS      25.47 seconds
TestRunnerSetup               PASS      559.10 seconds
TestRunner_l2cap-tester       PASS      14.57 seconds
IncrementalBuild              PASS      24.24 seconds



https://github.com/bluez/bluetooth-next/pull/1022

---
Regards,
Linux Bluetooth

Re: [PATCH v1] Bluetooth: L2CAP: Ignore connection responses with wrong ident

[Luiz Augusto von Dentz]

 Hi Jinwang,

On Thu, Oct 29, 2026 at 5:41 AM Jinwang Li <jinwang.li@oss.qualcomm.com> wrote:
>
> L2CAP/COS/CED/BI-28-C requires the IUT to ignore a Connection Response
> that carries an invalid Identifier.
>
> l2cap_connect_create_rsp() only checks that a connection request is
> outstanding, not that the response answers it. Add an ident check
> against the pending request so that a mismatched response is dropped.
>

Needs a Fixes tag.

> Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
> ---
>  net/bluetooth/l2cap_core.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 83b622a42811..70ad30b091e4 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -4480,11 +4480,11 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
>
>         lockdep_assert_held(&chan->conn->lock);
>
> -       /* Only accept a response to a connection request we sent and that
> -        * is still outstanding. A channel waiting in BT_CONNECT for security
> -        * or the feature mask has not sent one yet.
> +       /* Only accept a response matching a connection request we sent and
> +        * that is still outstanding. A channel waiting in BT_CONNECT for
> +        * security or the feature mask has not sent one yet.
>          */
> -       if (!l2cap_chan_connect_pending(chan))
> +       if (!l2cap_chan_connect_pending(chan) || chan->ident != cmd->ident)
>                 goto done;
>
>         switch (result) {
> --
> 2.34.1
>


-- 
Luiz Augusto von Dentz