[PATCH bluetooth-next v2] Bluetooth: L2CAP: validate MPS and MTU in ECRED connection response

[Joas Antonio dos Santos via B4 Relay]

From: Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>

l2cap_ecred_conn_rsp() stores the MTU and MPS from the peer without
checking them against the minimums required for enhanced credit based
channels.  The other LE and ECRED handlers (l2cap_le_connect_req(),
l2cap_le_connect_rsp(), l2cap_ecred_conn_req(), l2cap_ecred_reconf_req())
all reject values below the minimum.

With an MPS below L2CAP_SDULEN_SIZE, the pdu_len computation in
l2cap_segment_le_sdu() wraps:

	pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;

pdu_len is then clamped to the SDU length, which l2cap_chan_send() has
already limited to chan->omtu, so nothing is over-allocated and there is
no memory safety issue.  The result is that the whole SDU is sent as a
single PDU, larger than the MPS the peer announced, and a channel is
established with parameters the specification does not allow.

Apply the same L2CAP_ECRED_MIN_MTU / L2CAP_ECRED_MIN_MPS checks that
l2cap_ecred_conn_req() uses and drop the channel when the response
carries smaller values.

Found by LLM-assisted manual code review.

Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>
---
v1 claimed that a peer-supplied MPS of 0 leads to an oversized skb
allocation and potential memory corruption.  That was wrong, and I
apologize for the noise: in l2cap_segment_le_sdu() the wrapped pdu_len
is clamped to the SDU length, which l2cap_chan_send() has already
limited to chan->omtu, so there is no memory safety impact.  The
remaining problem is conformance only (PDUs larger than the MPS the
peer announced, and inconsistency with the other LE/ECRED handlers).
---
Changes in v2:
- Correct the commit message: no memory safety impact, drop the
  overstated claim from v1
- No code change
- Cc linux-bluetooth, which v1 missed
- Link to v1: https://lore.kernel.org/r/20261108-bt-ecred-mps-fix-v1-1-e7419bff6ee5@xxxxxxxxx
---
 net/bluetooth/l2cap_core.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 4dd56e007..c3b8f0f46 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5711,6 +5711,16 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
 				break;
 			}
 
+			/*
+			 * Validate MPS and MTU per BT Core Spec
+			 * Vol 3 Part A Sec 10.2
+			 */
+			if (mtu < L2CAP_ECRED_MIN_MTU ||
+			    mps < L2CAP_ECRED_MIN_MPS) {
+				l2cap_chan_del(chan, ECONNREFUSED);
+				break;
+			}
+
 			chan->ident = 0;
 			chan->dcid = dcid;
 			chan->omtu = mtu;

---
base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
change-id: 20261108-bt-ecred-mps-fix-a5f18dc06329

Best regards,
-- 
Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>