github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bluetooth: L2CAP: Only accept connection responses to outstanding requests

Browse Source 
An outgoing channel waits in BT_CONNECT until security
and the feature mask exchange complete, and only then
sends its connection request. A peer can answer it
before that with a connection response matching our
source CID. The channel then moves to BT_CONFIG,
completes configuration and becomes connected before
security has completed. If security then fails,
l2cap_security_cfm() leaves the connected channel
alone, so it stays up on a link that did not reach
the required security level.

A connection response with a zero source CID is
matched by identifier. Another channel can hold the
same identifier for a response it still has to send,
so the lookup can pick the wrong channel.

Only accept a connection response while our request
is outstanding, and only look at such channels when
matching by identifier.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Siwei Zhang 2026-10-13 11:36:37 -04:00 committed by Luiz Augusto von Dentz
parent 226fa3b676
commit a518b9a9ef
1 changed files with 29 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
net/bluetooth/l2cap_core.c
View File

@ -157,6 +157,29 @@ static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
return NULL;
}
/* Our connection request has been sent and is still outstanding */
static bool l2cap_chan_connect_pending(struct l2cap_chan *chan)
{
return chan->state == BT_CONNECT &&
test_bit(CONF_CONNECT_PEND, &chan->conf_state);
}
/* Other channels may hold the same ident for a response they still have
* to send, so only look at channels waiting for a connection response.
*/
static struct l2cap_chan *__l2cap_get_connect_chan_by_ident(struct l2cap_conn *conn,
u8 ident)
__must_hold(&conn->lock)
{
struct l2cap_chan *c;
list_for_each_entry(c, &conn->chan_l, list) {
if (c->ident == ident && l2cap_chan_connect_pending(c))
return c;
}
return NULL;
}
static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
u8 src_type)
__must_hold_shared(&chan_list_lock)
@ -4446,7 +4469,7 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
if (!chan)
return -EBADSLT;
} else {
chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
chan = __l2cap_get_connect_chan_by_ident(conn, cmd->ident);
if (!chan)
return -EBADSLT;
}
@ -4461,8 +4484,11 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
lockdep_assert_held(&chan->conn->lock);
/* Ignore a late response after the channel has left BT_CONNECT. */
if (chan->state != BT_CONNECT)
/* Only accept a response to a connection request we sent and that
* is still outstanding. A channel waiting in BT_CONNECT for security
* or the feature mask has not sent one yet.
*/
if (!l2cap_chan_connect_pending(chan))
goto done;
switch (result) {