[PATCH v1] Bluetooth: L2CAP: Ignore connection responses with wrong ident

[PATCH v1] Bluetooth: L2CAP: Ignore connection responses with wrong ident

[Jinwang Li]

L2CAP/COS/CED/BI-28-C requires the IUT to ignore a Connection Response
that carries an invalid Identifier.

l2cap_connect_create_rsp() only checks that a connection request is
outstanding, not that the response answers it. Add an ident check
against the pending request so that a mismatched response is dropped.

Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
---
 net/bluetooth/l2cap_core.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 83b622a42811..70ad30b091e4 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4480,11 +4480,11 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
 
 	lockdep_assert_held(&chan->conn->lock);
 
-	/* Only accept a response to a connection request we sent and that
-	 * is still outstanding. A channel waiting in BT_CONNECT for security
-	 * or the feature mask has not sent one yet.
+	/* Only accept a response matching a connection request we sent and
+	 * that is still outstanding. A channel waiting in BT_CONNECT for
+	 * security or the feature mask has not sent one yet.
 	 */
-	if (!l2cap_chan_connect_pending(chan))
+	if (!l2cap_chan_connect_pending(chan) || chan->ident != cmd->ident)
 		goto done;
 
 	switch (result) {
-- 
2.34.1

Re: [PATCH v1] Bluetooth: L2CAP: Ignore connection responses with wrong ident

[Luiz Augusto von Dentz]

 Hi Jinwang,

On Thu, Oct 29, 2026 at 5:41 AM Jinwang Li <jinwang.li@oss.qualcomm.com> wrote:
>
> L2CAP/COS/CED/BI-28-C requires the IUT to ignore a Connection Response
> that carries an invalid Identifier.
>
> l2cap_connect_create_rsp() only checks that a connection request is
> outstanding, not that the response answers it. Add an ident check
> against the pending request so that a mismatched response is dropped.
>

Needs a Fixes tag.

> Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
> ---
>  net/bluetooth/l2cap_core.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 83b622a42811..70ad30b091e4 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -4480,11 +4480,11 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
>
>         lockdep_assert_held(&chan->conn->lock);
>
> -       /* Only accept a response to a connection request we sent and that
> -        * is still outstanding. A channel waiting in BT_CONNECT for security
> -        * or the feature mask has not sent one yet.
> +       /* Only accept a response matching a connection request we sent and
> +        * that is still outstanding. A channel waiting in BT_CONNECT for
> +        * security or the feature mask has not sent one yet.
>          */
> -       if (!l2cap_chan_connect_pending(chan))
> +       if (!l2cap_chan_connect_pending(chan) || chan->ident != cmd->ident)
>                 goto done;
>
>         switch (result) {
> --
> 2.34.1
>


-- 
Luiz Augusto von Dentz

Re: [PATCH v1] Bluetooth: L2CAP: Ignore connection responses with wrong ident

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 29 Oct 2026 17:41:04 +0800 you wrote:
> L2CAP/COS/CED/BI-28-C requires the IUT to ignore a Connection Response
> that carries an invalid Identifier.
> 
> l2cap_connect_create_rsp() only checks that a connection request is
> outstanding, not that the response answers it. Add an ident check
> against the pending request so that a mismatched response is dropped.
> 
> [...]

Here is the summary with links:
  - [v1] Bluetooth: L2CAP: Ignore connection responses with wrong ident
    https://git.kernel.org/bluetooth/bluetooth-next/c/11701044c532

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html