Bluetooth: Host: Add conn rsp param check

Check whether the connection response parameters both with and without
ECRED are within the valid ranges from the Bluetooth Core Specification
(part 3.A.4 v6.0).

Signed-off-by: Håvard Reierstad <[email protected]>

Author: HaavardRei

include/zephyr/bluetooth/l2cap.h

@@ -111,6 +111,13 @@ extern "C" {
  */
 #define BT_L2CAP_ECRED_MIN_MPS 64
 
+/** @brief L2CAP maximum MPS
+ *
+ *  The maximum MPS for an L2CAP Based Connection. This is the same with or without ECRED. This
+ *  requirement is taken from text in Core 3.A.4.22 and 3.A.4.26 v6.0.
+ */
+#define BT_L2CAP_MAX_MPS 65533
+
 /** @brief The maximum number of channels in ECRED L2CAP signaling PDUs
  *
  *  Currently, this is the maximum number of channels referred to in the

subsys/bluetooth/host/l2cap.c

@@ -1929,6 +1929,22 @@ static void le_ecred_conn_rsp(struct bt_l2cap *l2cap, uint8_t ident,
 
 	LOG_DBG("mtu 0x%04x mps 0x%04x credits 0x%04x result %u", mtu, mps, credits, result);
 
+	/* Validate parameters on successful connection. There are no limits for
+	 * credits as values from 0 to UINT16_MAX are valid.
+	 */
+	if (result == BT_L2CAP_LE_SUCCESS) {
+		if (!L2CAP_LE_CID_IS_DYN(dcid)) {
+			LOG_ERR("dcid 0x%04x is not dynamic", dcid);
+			result = BT_L2CAP_LE_ERR_UNACCEPT_PARAMS;
+		} else if (!IN_RANGE(mtu, BT_L2CAP_ECRED_MIN_MTU, UINT16_MAX)) {
+			LOG_ERR("Invalid mtu %u", mtu);
+			result = BT_L2CAP_LE_ERR_UNACCEPT_PARAMS;
+		} else if (!IN_RANGE(mps, BT_L2CAP_ECRED_MIN_MPS, BT_L2CAP_MAX_MPS)) {
+			LOG_ERR("Invalid mps %u", mps);
+			result = BT_L2CAP_LE_ERR_UNACCEPT_PARAMS;
+		}
+	}
+
 	chan = l2cap_lookup_ident(conn, ident);
 	if (chan) {
 		psm = chan->psm;
@@ -2059,6 +2075,22 @@ static void le_conn_rsp(struct bt_l2cap *l2cap, uint8_t ident,
 	LOG_DBG("dcid 0x%04x mtu %u mps %u credits %u result 0x%04x", dcid, mtu, mps, credits,
 		result);
 
+	/* Validate parameters on successful connection. There are no limits for
+	 * credits as values from 0 to UINT16_MAX are valid.
+	 */
+	if (result == BT_L2CAP_LE_SUCCESS) {
+		if (!L2CAP_LE_CID_IS_DYN(dcid)) {
+			LOG_ERR("dcid 0x%04x is not dynamic", dcid);
+			result = BT_L2CAP_LE_ERR_UNACCEPT_PARAMS;
+		} else if (!IN_RANGE(mtu, L2CAP_LE_MIN_MTU, UINT16_MAX)) {
+			LOG_ERR("Invalid mtu: %u", mtu);
+			result = BT_L2CAP_LE_ERR_UNACCEPT_PARAMS;
+		} else if (!IN_RANGE(mps, L2CAP_LE_MIN_MPS, BT_L2CAP_MAX_MPS)) {
+			LOG_ERR("Invalid mps: %u", mps);
+			result = BT_L2CAP_LE_ERR_UNACCEPT_PARAMS;
+		}
+	}
+
 	/* Keep the channel in case of security errors */
 	if (result == BT_L2CAP_LE_SUCCESS ||
 	    result == BT_L2CAP_LE_ERR_AUTHENTICATION ||