tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req

The L2CAP specification states that if more than one channel is being
reconfigured, the MPS shall not be decreased. The current check has
two issues:

1) The comparison uses >= (greater-than-or-equal), which incorrectly
rejects reconfiguration requests where the MPS stays the same.
Since the spec says MPS "shall be greater than or equal to the
current MPS", only a strict decrease (remote_mps > mps) should be
rejected. Keeping the same MPS is valid.

2) The multi-channel guard uses `&& i` (loop index) to approximate
"more than one channel", but this incorrectly allows MPS decrease
for the first channel (i==0) even when multiple channels are being
reconfigured. Replace with `&& num_scid > 1` which correctly
checks whether the request covers more than one channel.

Fixes: 7accb1c4321a ("Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ")
Signed-off-by: Dudu Lu <phx0fer@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

authored by

Dudu Lu and committed by
Luiz Augusto von Dentz 4f42363c 72b8decc

+1 -1
+1 -1
net/bluetooth/l2cap_core.c
··· 5428 5428 * configured, the MPS field may be less than the current MPS 5429 5429 * of that channel. 5430 5430 */ 5431 - if (chan[i]->remote_mps >= mps && i) { 5431 + if (chan[i]->remote_mps > mps && num_scid > 1) { 5432 5432 BT_ERR("chan %p decreased MPS %u -> %u", chan[i], 5433 5433 chan[i]->remote_mps, mps); 5434 5434 result = L2CAP_RECONF_INVALID_MPS;