[PATCH bluetooth-next v2] Bluetooth: L2CAP: validate MPS and MTU in ECRED connection response

[PATCH bluetooth-next v2] Bluetooth: L2CAP: validate MPS and MTU in ECRED connection response

[Joas Antonio dos Santos via B4 Relay]

From: Joas Antonio dos Santos <joasantonio108@gmail.com>

l2cap_ecred_conn_rsp() stores the MTU and MPS from the peer without
checking them against the minimums required for enhanced credit based
channels.  The other LE and ECRED handlers (l2cap_le_connect_req(),
l2cap_le_connect_rsp(), l2cap_ecred_conn_req(), l2cap_ecred_reconf_req())
all reject values below the minimum.

With an MPS below L2CAP_SDULEN_SIZE, the pdu_len computation in
l2cap_segment_le_sdu() wraps:

	pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;

pdu_len is then clamped to the SDU length, which l2cap_chan_send() has
already limited to chan->omtu, so nothing is over-allocated and there is
no memory safety issue.  The result is that the whole SDU is sent as a
single PDU, larger than the MPS the peer announced, and a channel is
established with parameters the specification does not allow.

Apply the same L2CAP_ECRED_MIN_MTU / L2CAP_ECRED_MIN_MPS checks that
l2cap_ecred_conn_req() uses and drop the channel when the response
carries smaller values.

Found by LLM-assisted manual code review.

Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
---
v1 claimed that a peer-supplied MPS of 0 leads to an oversized skb
allocation and potential memory corruption.  That was wrong, and I
apologize for the noise: in l2cap_segment_le_sdu() the wrapped pdu_len
is clamped to the SDU length, which l2cap_chan_send() has already
limited to chan->omtu, so there is no memory safety impact.  The
remaining problem is conformance only (PDUs larger than the MPS the
peer announced, and inconsistency with the other LE/ECRED handlers).
---
Changes in v2:
- Correct the commit message: no memory safety impact, drop the
  overstated claim from v1
- No code change
- Cc linux-bluetooth, which v1 missed
- Link to v1: https://lore.kernel.org/r/20261108-bt-ecred-mps-fix-v1-1-e7419bff6ee5@gmail.com
---
 net/bluetooth/l2cap_core.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 4dd56e007..c3b8f0f46 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5711,6 +5711,16 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
 				break;
 			}
 
+			/*
+			 * Validate MPS and MTU per BT Core Spec
+			 * Vol 3 Part A Sec 10.2
+			 */
+			if (mtu < L2CAP_ECRED_MIN_MTU ||
+			    mps < L2CAP_ECRED_MIN_MPS) {
+				l2cap_chan_del(chan, ECONNREFUSED);
+				break;
+			}
+
 			chan->ident = 0;
 			chan->dcid = dcid;
 			chan->omtu = mtu;

---
base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
change-id: 20261108-bt-ecred-mps-fix-a5f18dc06329

Best regards,
-- 
Joas Antonio dos Santos <joasantonio108@gmail.com>

RE: [bluetooth-next,v2] Bluetooth: L2CAP: validate MPS and MTU in ECRED connection response

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1477 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1206665/

---Test result---

Test Summary:
CheckPatch                    PASS      0.78 seconds
VerifyFixes                   PASS      0.13 seconds
VerifySignedoff               PASS      0.13 seconds
GitLint                       FAIL      0.47 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      31.32 seconds
CheckAllWarning               PASS      35.44 seconds
CheckSparse                   PASS      38.16 seconds
BuildKernel32                 PASS      31.60 seconds
CheckKernelLLVM               PASS      34.54 seconds
TestRunnerSetup               PASS      753.62 seconds
TestRunner_l2cap-tester       PASS      12.73 seconds
IncrementalBuild              PASS      29.68 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[bluetooth-next,v2] Bluetooth: L2CAP: validate MPS and MTU in ECRED connection response

1: T1 Title exceeds max length (87>80): "[bluetooth-next,v2] Bluetooth: L2CAP: validate MPS and MTU in ECRED connection response"
14: B3 Line contains hard tab characters (\t): "	pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;"


https://github.com/bluez/bluetooth-next/pull/1097

---
Regards,
Linux Bluetooth

Re: [PATCH bluetooth-next v2] Bluetooth: L2CAP: validate MPS and MTU in ECRED connection response

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 10 Nov 2026 03:26:03 +0000 you wrote:
> From: Joas Antonio dos Santos <joasantonio108@gmail.com>
> 
> l2cap_ecred_conn_rsp() stores the MTU and MPS from the peer without
> checking them against the minimums required for enhanced credit based
> channels.  The other LE and ECRED handlers (l2cap_le_connect_req(),
> l2cap_le_connect_rsp(), l2cap_ecred_conn_req(), l2cap_ecred_reconf_req())
> all reject values below the minimum.
> 
> [...]

Here is the summary with links:
  - [bluetooth-next,v2] Bluetooth: L2CAP: validate MPS and MTU in ECRED connection response
    https://git.kernel.org/bluetooth/bluetooth-next/c/1645edfa8c29

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html