Re: [PATCH v1] Bluetooth: L2CAP: Ignore connection responses with wrong ident

[Luiz Augusto von Dentz]

 Hi Jinwang,

On Thu, Oct 29, 2026 at 5:41 AM Jinwang Li <jinwang.li@xxxxxxxxxxxxxxxx> wrote:
>
> L2CAP/COS/CED/BI-28-C requires the IUT to ignore a Connection Response
> that carries an invalid Identifier.
>
> l2cap_connect_create_rsp() only checks that a connection request is
> outstanding, not that the response answers it. Add an ident check
> against the pending request so that a mismatched response is dropped.
>

Needs a Fixes tag.

> Signed-off-by: Jinwang Li <jinwang.li@xxxxxxxxxxxxxxxx>
> ---
>  net/bluetooth/l2cap_core.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 83b622a42811..70ad30b091e4 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -4480,11 +4480,11 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
>
>         lockdep_assert_held(&chan->conn->lock);
>
> -       /* Only accept a response to a connection request we sent and that
> -        * is still outstanding. A channel waiting in BT_CONNECT for security
> -        * or the feature mask has not sent one yet.
> +       /* Only accept a response matching a connection request we sent and
> +        * that is still outstanding. A channel waiting in BT_CONNECT for
> +        * security or the feature mask has not sent one yet.
>          */
> -       if (!l2cap_chan_connect_pending(chan))
> +       if (!l2cap_chan_connect_pending(chan) || chan->ident != cmd->ident)
>                 goto done;
>
>         switch (result) {
> --
> 2.34.1
>


-- 
Luiz Augusto von Dentz