Skip to content

Bluetooth: Host: Add conn rsp param check #93174

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
+47 −6
Open

Bluetooth: Host: Add conn rsp param check #93174

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0f64b95
Bluetooth: Host: Add conn rsp param check
HaavardRei Jul 16, 2025
c0bb28c
Bluetooth: Host: Use MTU min for l2cap test
HaavardRei Jul 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions include/zephyr/bluetooth/l2cap.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,13 @@ extern "C" {
*/
#define BT_L2CAP_ECRED_MIN_MPS 64

/** @brief L2CAP maximum MPS
*
* The maximum MPS for an L2CAP Based Connection. This is the same with or without ECRED. This
* requirement is taken from text in Core 3.A.4.22 and 3.A.4.26 v6.0.
*/
#define BT_L2CAP_MAX_MPS 65533

/** @brief The maximum number of channels in ECRED L2CAP signaling PDUs
*
* Currently, this is the maximum number of channels referred to in the
Expand Down
44 changes: 39 additions & 5 deletions subsys/bluetooth/host/l2cap.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1475,7 +1475,11 @@ static void le_conn_req(struct bt_l2cap *l2cap, uint8_t ident,

LOG_DBG("psm 0x%02x scid 0x%04x mtu %u mps %u credits %u", psm, scid, mtu, mps, credits);

if (mtu < L2CAP_LE_MIN_MTU || mps < L2CAP_LE_MIN_MPS) {
/* Validate parameters. Requirements are from (Core Spec v6.0, Vol 3.A.4.22). Valid credit
* range is from 0 to UINT16_MAX.
*/
if (!IN_RANGE(mtu, L2CAP_LE_MIN_MTU, UINT16_MAX) ||
!IN_RANGE(mps, L2CAP_LE_MIN_MPS, BT_L2CAP_MAX_MPS)) {
LOG_ERR("Invalid LE-Conn Req params: mtu %u mps %u", mtu, mps);
return;
}
Expand Down Expand Up @@ -1574,8 +1578,12 @@ static void le_ecred_conn_req(struct bt_l2cap *l2cap, uint8_t ident,

LOG_DBG("psm 0x%02x mtu %u mps %u credits %u", psm, mtu, mps, credits);

if (mtu < BT_L2CAP_ECRED_MIN_MTU || mps < BT_L2CAP_ECRED_MIN_MPS) {
LOG_ERR("Invalid ecred conn req params. mtu %u mps %u", mtu, mps);
/* Validate parameters. Requirements are from Core Spec v6.0, Vol 3.A.4.25. */
if (!IN_RANGE(mtu, BT_L2CAP_ECRED_MIN_MTU, UINT16_MAX) ||
!IN_RANGE(mps, BT_L2CAP_ECRED_MIN_MPS, BT_L2CAP_MAX_MPS) ||
!IN_RANGE(credits, 1, UINT16_MAX)) {
LOG_ERR("Invalid ecred conn req params. mtu %u mps %u credits %u", mtu, mps,
credits);
result = BT_L2CAP_LE_ERR_INVALID_PARAMS;
goto response;
}
Expand Down Expand Up @@ -1978,10 +1986,17 @@ static void le_ecred_conn_rsp(struct bt_l2cap *l2cap, uint8_t ident,

LOG_DBG("dcid 0x%04x", dcid);

/* If a Destination CID is 0x0000, the channel was not
/* Validate parameters before assignment. Requirements are from Core Spec
* v6.0, Vol 3.A.4.26. If a Destination CID is 0x0000, the channel was not
* established.
*/
if (!dcid) {
if (!dcid || !L2CAP_LE_CID_IS_DYN(dcid) ||
!IN_RANGE(mtu, BT_L2CAP_ECRED_MIN_MTU, UINT16_MAX) ||
!IN_RANGE(mps, BT_L2CAP_ECRED_MIN_MPS, BT_L2CAP_MAX_MPS) ||
!IN_RANGE(credits, 1, UINT16_MAX)) {
LOG_WRN("Invalid ecred conn rsp params. dcid 0x%04x mtu %u mps %u "
"credits %u. Terminating connection",
dcid, mtu, mps, credits);
bt_l2cap_chan_remove(conn, &chan->chan);
bt_l2cap_chan_del(&chan->chan);
continue;
Expand Down Expand Up @@ -2060,6 +2075,25 @@ static void le_conn_rsp(struct bt_l2cap *l2cap, uint8_t ident,
LOG_DBG("dcid 0x%04x mtu %u mps %u credits %u result 0x%04x", dcid, mtu, mps, credits,
result);

/* Validate parameters on successful connection. Requirements are from Core Spec v6.0,
* Vol 3.A.4.23. Valid credit range is from 0 to UINT16_MAX.
*/
if (result == BT_L2CAP_LE_SUCCESS && (!L2CAP_LE_CID_IS_DYN(dcid) ||
!IN_RANGE(mtu, L2CAP_LE_MIN_MTU, UINT16_MAX) ||
!IN_RANGE(mps, L2CAP_LE_MIN_MPS, BT_L2CAP_MAX_MPS))) {
LOG_WRN("Invalid conn rsp params. dcid 0x%04x mtu %u mps %u credits %u. "
"Terminating connection",
dcid, mtu, mps, credits);
chan = l2cap_remove_ident(conn, ident);
if (chan) {
bt_l2cap_chan_remove(conn, &chan->chan);
bt_l2cap_chan_del(&chan->chan);
} else {
LOG_WRN("Cannot find channel for ident %u", ident);
}
return;
}

/* Keep the channel in case of security errors */
if (result == BT_L2CAP_LE_SUCCESS ||
result == BT_L2CAP_LE_ERR_AUTHENTICATION ||
Expand Down
2 changes: 1 addition & 1 deletion tests/bsim/bluetooth/host/l2cap/many_conns/src/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ DEFINE_FLAG_STATIC(flag_l2cap_connected);
#define NUM_PERIPHERALS CONFIG_BT_MAX_CONN
#define L2CAP_CHANS NUM_PERIPHERALS
#define SDU_NUM 1
#define SDU_LEN 10
#define SDU_LEN 23

/* Only one SDU per link will be transmitted */
NET_BUF_POOL_DEFINE(sdu_tx_pool,
Expand Down