github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bluetooth: L2CAP: Ignore connection responses with wrong ident

Browse Source 
L2CAP/COS/CED/BI-28-C requires the IUT to ignore a Connection Response
that carries an invalid Identifier.

l2cap_connect_create_rsp() only checks that a connection request is
outstanding, not that the response answers it. Add an ident check
against the pending request so that a mismatched response is dropped.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Jinwang Li 2026-10-29 17:41:04 +08:00 committed by Luiz Augusto von Dentz
parent d90f24dc38
commit a9f9eeb534
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
net/bluetooth/l2cap_core.c
View File

@ -4480,11 +4480,11 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
lockdep_assert_held(&chan->conn->lock);
/* Only accept a response to a connection request we sent and that
* is still outstanding. A channel waiting in BT_CONNECT for security
* or the feature mask has not sent one yet.
/* Only accept a response matching a connection request we sent and
* that is still outstanding. A channel waiting in BT_CONNECT for
* security or the feature mask has not sent one yet.
*/
if (!l2cap_chan_connect_pending(chan))
if (!l2cap_chan_connect_pending(chan) || chan->ident != cmd->ident)
goto done;
switch (result) {