From c1398cf11b31a94c27ed810ba69515e0df5ce379 Mon Sep 17 00:00:00 2001 From: Siwei Zhang Date: Tue, 13 Oct 2026 11:36:33 -0400 Subject: [PATCH] Bluetooth: L2CAP: Reject mode changes on connected channels A peer can send a configuration response with an RFC option for another mode to a connected channel, for example to switch it from Streaming to ERTM mode. l2cap_parse_conf_rsp() then changes chan->mode, but l2cap_ertm_init() is not called again, so the ERTM sequence lists are never allocated. The next out-of-sequence I-frame makes l2cap_seq_list_clear() write through the NULL srej_list.list. Refuse the channel when a response tries to change the mode of a connected channel. Fixes: f2fcfcd67025 ("Bluetooth: Add configuration support for ERTM and Streaming mode") Cc: stable@vger.kernel.org Closes: https://sashiko.dev/#/patchset/20261007144717.3832330-1-oss%40fourdim.xyz Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Siwei Zhang Signed-off-by: Luiz Augusto von Dentz --- net/bluetooth/l2cap_core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 49a998804908..c730da87734b 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -3876,7 +3876,11 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, } } - if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode) + /* A connected channel cannot change its mode, as the new mode would + * not be initialized. + */ + if (chan->mode != rfc.mode && + (chan->mode == L2CAP_MODE_BASIC || chan->state == BT_CONNECTED)) return -ECONNREFUSED; chan->mode = rfc.mode;