Re: [RFC PATCH] Bluetooth: L2CAP: tolerate zero-ident LE credit indications

[cochcoder]

Thanks for flagging this. I've sent v3 as a two-patch series:
the security fix first, followed by the dependent zero-ID RFC.

Security fix:
https://lore.kernel.org/r/20261015181624.48318-1-cochcoder@xxxxxxxxx

Zero-ID RFC:
https://lore.kernel.org/r/20261015181624.48318-2-cochcoder@xxxxxxxxx

Thanks,
Kyle


On Tuesday, October 13th, 2026 at 10:44 AM, Luiz Augusto von Dentz <luiz.dentz@xxxxxxxxx> wrote:

> Hi Kyle,
> 
> On Mon, Oct 12, 2026 at 11:20 PM Kyle Pepper <cochcoder@xxxxxxxxx> wrote:
> >
> > A nonconforming ASHA peer sends identifier-zero credit indications
> > that are discarded, reducing usable transmit credits until audio stalls.
> >
> > Tolerate only exact-size credit indications for a connected LE CoC.
> > Preserve the channel reference, lock and credit-overflow checks and do
> > not send a response with identifier zero. Other zero-ID commands and
> > BR/EDR signaling remain unchanged.
> >
> > Core Vol 3 Part A section 4 forbids identifier zero. This is an
> > interoperability RFC requiring maintainer agreement, not a conformance
> > fix or a claim of automatic stream recovery.
> >
> > Assisted-by: OpenCode:gpt-6.1-sol
> > Signed-off-by: Kyle Pepper <cochcoder@xxxxxxxxx>
> > ---
> > Submission review notes (not part of the commit message):
> > Core specification forbids identifier zero. This is a narrow opcode
> > interoperability exception, not a conformance fix. N8 captures contain
> > zero-ID credit indications. Native malformed/overflow/teardown and
> > lockdep/KASAN coverage and exception policy remain review gates.
> >
> >  net/bluetooth/l2cap_core.c | 18 +++++++++++++++++-
> >  1 file changed, 17 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> > index 49a998804..1a0868437 100644
> > --- a/net/bluetooth/l2cap_core.c
> > +++ b/net/bluetooth/l2cap_core.c
> > @@ -5328,6 +5328,12 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
> >
> >         l2cap_chan_lock(chan);
> >
> > +       /* Tolerate identifier-zero credits only for a live LE CoC. */
> > +       if (!cmd->ident &&
> > +           (!credits || chan->state != BT_CONNECTED ||
> > +            chan->mode != L2CAP_MODE_LE_FLOWCTL))
> > +               goto unlock;
> > +
> >         max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
> >         if (credits > max_credits) {
> >                 BT_ERR("LE credits overflow");
> > @@ -5923,11 +5929,21 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
> >
> >         BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
> >
> > -       if (len != skb->len || !cmd->ident) {
> > +       if (len != skb->len) {
> >                 BT_DBG("corrupted command");
> >                 goto drop;
> >         }
> >
> > +       if (!cmd->ident) {
> > +               if (cmd->code != L2CAP_LE_CREDITS ||
> > +                   len != sizeof(struct l2cap_le_credits))
> > +                       goto drop;
> > +
> > +               /* Credits have no response or identifier-matched transaction. */
> > +               l2cap_le_credits(conn, cmd, len, skb->data);
> > +               goto drop;
> > +       }
> > +
> >         err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
> >         if (err) {
> >                 struct l2cap_cmd_rej_unk rej;
> >
> > base-commit: 964430c038967fd06643e866f68115664e1a1bd1
> 
> Sashiko flagged a problem with this:
> 
> https://sashiko.dev/#/patchset/20261013031943.489829-1-cochcoder%40proton.me
> 
> --
> Luiz Augusto von Dentz
>