[RFC PATCH v2] Bluetooth: L2CAP: tolerate zero-ident LE credit indications

[Kyle Pepper]

Tolerate exact-size, nonzero credit grants with identifier zero only
for connected LE credit-based channels. Keep the target and pending
security checks shared with ordinary identifiers. Do not send a
response with identifier zero or relax other signaling commands.

This is an interoperability exception to Core Vol 3 Part A section 4,
not a conformance fix.

Assisted-by: OpenCode:gpt-6.1-sol
Signed-off-by: Kyle Pepper <cochcoder@xxxxxxxxx>
---
Changes since v1:
- Depend on the separately submitted target/state and pending-security fix.
- Require a connected ordinary LE CoC, an exact-size indication and a nonzero
  grant. Keep fixed/unready targets and ECRED identifier-zero grants excluded.
- Preserve shared target/security checks for normal and zero identifiers.
- Do not generate any response with identifier zero or relax other commands.

REQUIRED security dependency, submitted separately and not resent here:
https://lore.kernel.org/linux-bluetooth/20261015052018.129971-1-cochcoder@xxxxxxxxx/
Signed dependency commit: 61a7ca610078ddf616873e7d4914cb6ac9eae7a3.
Apply it first. This mail includes its prerequisite patch-id against upstream
397464709a20. The resulting source tree matches the validated refreshed pair.

The Core specification still forbids identifier zero. This remains an
interoperability RFC requiring maintainer policy agreement, not a conformance
fix. The separate security patch is independently useful without this exception.

Fresh current-base controls: all nine focused security cases pass with either
security-only or combined kernels. Public credit controls pass 13/14 with
security-only (expected positive zero-ID failure), and 14/14 with this revision
added. No skips or captured KASAN/lockdep alerts occurred in these focused runs.
GCC W=1 changed objects and source-extracted security/target/zero-ID fixtures pass.

The refreshed full suite is NOT claimed passing: SCI Fast Mode encounters an
invalid response length for HCI opcode 0x20a3 and times out without a complete
summary. The same SCI failure reproduces on unpatched current upstream and both
revised guests. Initial spaced VM selectors selected broader tests; corrected
space-free credit runs are the focused results above. Earlier 134/134 combined
results belong to the older reference base, not this fresh full-suite attempt.

The combined Arch integration is reported working on hardware, not isolated
attribution or exhaustive device/security/teardown coverage. No remote CI pass
or severity claim is made. Private security reproducer/logs are not included.
Confirm archive rendering of the dependency link before sending.

 net/bluetooth/l2cap_core.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 7a7f30531..d805b1c62 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5396,6 +5396,10 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
 	     chan->mode != L2CAP_MODE_EXT_FLOWCTL))
 		goto unlock;
 
+	/* Tolerate identifier-zero credits only for a live LE CoC. */
+	if (!cmd->ident && (!credits || chan->mode != L2CAP_MODE_LE_FLOWCTL))
+		goto unlock;
+
 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
 	if (credits > max_credits) {
 		BT_ERR("LE credits overflow");
@@ -5994,11 +5998,21 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
 
 	BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
 
-	if (len != skb->len || !cmd->ident) {
+	if (len != skb->len) {
 		BT_DBG("corrupted command");
 		goto drop;
 	}
 
+	if (!cmd->ident) {
+		if (cmd->code != L2CAP_LE_CREDITS ||
+		    len != sizeof(struct l2cap_le_credits))
+			goto drop;
+
+		/* Credits have no response or identifier-matched transaction. */
+		l2cap_le_credits(conn, cmd, len, skb->data);
+		goto drop;
+	}
+
 	err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
 	if (err) {
 		struct l2cap_cmd_rej_unk rej;

base-commit: 397464709a204da9b8dc3b01d6ea42539d951cd2
prerequisite-patch-id: 658bb8f3b3e38bbbb21f2619434affc641582b7f