[RFC PATCH] Bluetooth: L2CAP: tolerate zero-ident LE credit indications

[RFC PATCH] Bluetooth: L2CAP: tolerate zero-ident LE credit indications

[Kyle Pepper]

A nonconforming ASHA peer sends identifier-zero credit indications
that are discarded, reducing usable transmit credits until audio stalls.

Tolerate only exact-size credit indications for a connected LE CoC.
Preserve the channel reference, lock and credit-overflow checks and do
not send a response with identifier zero. Other zero-ID commands and
BR/EDR signaling remain unchanged.

Core Vol 3 Part A section 4 forbids identifier zero. This is an
interoperability RFC requiring maintainer agreement, not a conformance
fix or a claim of automatic stream recovery.

Assisted-by: OpenCode:gpt-6.1-sol
Signed-off-by: Kyle Pepper <cochcoder@proton.me>
---
Submission review notes (not part of the commit message):
Core specification forbids identifier zero. This is a narrow opcode
interoperability exception, not a conformance fix. N8 captures contain
zero-ID credit indications. Native malformed/overflow/teardown and
lockdep/KASAN coverage and exception policy remain review gates.

 net/bluetooth/l2cap_core.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 49a998804..1a0868437 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5328,6 +5328,12 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
 
 	l2cap_chan_lock(chan);
 
+	/* Tolerate identifier-zero credits only for a live LE CoC. */
+	if (!cmd->ident &&
+	    (!credits || chan->state != BT_CONNECTED ||
+	     chan->mode != L2CAP_MODE_LE_FLOWCTL))
+		goto unlock;
+
 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
 	if (credits > max_credits) {
 		BT_ERR("LE credits overflow");
@@ -5923,11 +5929,21 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
 
 	BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
 
-	if (len != skb->len || !cmd->ident) {
+	if (len != skb->len) {
 		BT_DBG("corrupted command");
 		goto drop;
 	}
 
+	if (!cmd->ident) {
+		if (cmd->code != L2CAP_LE_CREDITS ||
+		    len != sizeof(struct l2cap_le_credits))
+			goto drop;
+
+		/* Credits have no response or identifier-matched transaction. */
+		l2cap_le_credits(conn, cmd, len, skb->data);
+		goto drop;
+	}
+
 	err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
 	if (err) {
 		struct l2cap_cmd_rej_unk rej;

base-commit: 964430c038967fd06643e866f68115664e1a1bd1

Re: [RFC PATCH] Bluetooth: L2CAP: tolerate zero-ident LE credit indications

[Luiz Augusto von Dentz]

Hi Kyle,

On Mon, Oct 12, 2026 at 11:20 PM Kyle Pepper <cochcoder@proton.me> wrote:
>
> A nonconforming ASHA peer sends identifier-zero credit indications
> that are discarded, reducing usable transmit credits until audio stalls.
>
> Tolerate only exact-size credit indications for a connected LE CoC.
> Preserve the channel reference, lock and credit-overflow checks and do
> not send a response with identifier zero. Other zero-ID commands and
> BR/EDR signaling remain unchanged.
>
> Core Vol 3 Part A section 4 forbids identifier zero. This is an
> interoperability RFC requiring maintainer agreement, not a conformance
> fix or a claim of automatic stream recovery.
>
> Assisted-by: OpenCode:gpt-6.1-sol
> Signed-off-by: Kyle Pepper <cochcoder@proton.me>
> ---
> Submission review notes (not part of the commit message):
> Core specification forbids identifier zero. This is a narrow opcode
> interoperability exception, not a conformance fix. N8 captures contain
> zero-ID credit indications. Native malformed/overflow/teardown and
> lockdep/KASAN coverage and exception policy remain review gates.
>
>  net/bluetooth/l2cap_core.c | 18 +++++++++++++++++-
>  1 file changed, 17 insertions(+), 1 deletion(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 49a998804..1a0868437 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -5328,6 +5328,12 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
>
>         l2cap_chan_lock(chan);
>
> +       /* Tolerate identifier-zero credits only for a live LE CoC. */
> +       if (!cmd->ident &&
> +           (!credits || chan->state != BT_CONNECTED ||
> +            chan->mode != L2CAP_MODE_LE_FLOWCTL))
> +               goto unlock;
> +
>         max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
>         if (credits > max_credits) {
>                 BT_ERR("LE credits overflow");
> @@ -5923,11 +5929,21 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
>
>         BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
>
> -       if (len != skb->len || !cmd->ident) {
> +       if (len != skb->len) {
>                 BT_DBG("corrupted command");
>                 goto drop;
>         }
>
> +       if (!cmd->ident) {
> +               if (cmd->code != L2CAP_LE_CREDITS ||
> +                   len != sizeof(struct l2cap_le_credits))
> +                       goto drop;
> +
> +               /* Credits have no response or identifier-matched transaction. */
> +               l2cap_le_credits(conn, cmd, len, skb->data);
> +               goto drop;
> +       }
> +
>         err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
>         if (err) {
>                 struct l2cap_cmd_rej_unk rej;
>
> base-commit: 964430c038967fd06643e866f68115664e1a1bd1

Sashiko flagged a problem with this:

https://sashiko.dev/#/patchset/20261013031943.489829-1-cochcoder%40proton.me

-- 
Luiz Augusto von Dentz

Re: [RFC PATCH] Bluetooth: L2CAP: tolerate zero-ident LE credit indications

[cochcoder]

Thanks for flagging this. I've sent v3 as a two-patch series:
the security fix first, followed by the dependent zero-ID RFC.

Security fix:
https://lore.kernel.org/r/20261015181624.48318-1-cochcoder@proton.me

Zero-ID RFC:
https://lore.kernel.org/r/20261015181624.48318-2-cochcoder@proton.me

Thanks,
Kyle


On Tuesday, October 13th, 2026 at 10:44 AM, Luiz Augusto von Dentz <luiz.dentz@gmail.com> wrote:

> Hi Kyle,
> 
> On Mon, Oct 12, 2026 at 11:20 PM Kyle Pepper <cochcoder@proton.me> wrote:
> >
> > A nonconforming ASHA peer sends identifier-zero credit indications
> > that are discarded, reducing usable transmit credits until audio stalls.
> >
> > Tolerate only exact-size credit indications for a connected LE CoC.
> > Preserve the channel reference, lock and credit-overflow checks and do
> > not send a response with identifier zero. Other zero-ID commands and
> > BR/EDR signaling remain unchanged.
> >
> > Core Vol 3 Part A section 4 forbids identifier zero. This is an
> > interoperability RFC requiring maintainer agreement, not a conformance
> > fix or a claim of automatic stream recovery.
> >
> > Assisted-by: OpenCode:gpt-6.1-sol
> > Signed-off-by: Kyle Pepper <cochcoder@proton.me>
> > ---
> > Submission review notes (not part of the commit message):
> > Core specification forbids identifier zero. This is a narrow opcode
> > interoperability exception, not a conformance fix. N8 captures contain
> > zero-ID credit indications. Native malformed/overflow/teardown and
> > lockdep/KASAN coverage and exception policy remain review gates.
> >
> >  net/bluetooth/l2cap_core.c | 18 +++++++++++++++++-
> >  1 file changed, 17 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> > index 49a998804..1a0868437 100644
> > --- a/net/bluetooth/l2cap_core.c
> > +++ b/net/bluetooth/l2cap_core.c
> > @@ -5328,6 +5328,12 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
> >
> >         l2cap_chan_lock(chan);
> >
> > +       /* Tolerate identifier-zero credits only for a live LE CoC. */
> > +       if (!cmd->ident &&
> > +           (!credits || chan->state != BT_CONNECTED ||
> > +            chan->mode != L2CAP_MODE_LE_FLOWCTL))
> > +               goto unlock;
> > +
> >         max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
> >         if (credits > max_credits) {
> >                 BT_ERR("LE credits overflow");
> > @@ -5923,11 +5929,21 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
> >
> >         BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
> >
> > -       if (len != skb->len || !cmd->ident) {
> > +       if (len != skb->len) {
> >                 BT_DBG("corrupted command");
> >                 goto drop;
> >         }
> >
> > +       if (!cmd->ident) {
> > +               if (cmd->code != L2CAP_LE_CREDITS ||
> > +                   len != sizeof(struct l2cap_le_credits))
> > +                       goto drop;
> > +
> > +               /* Credits have no response or identifier-matched transaction. */
> > +               l2cap_le_credits(conn, cmd, len, skb->data);
> > +               goto drop;
> > +       }
> > +
> >         err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
> >         if (err) {
> >                 struct l2cap_cmd_rej_unk rej;
> >
> > base-commit: 964430c038967fd06643e866f68115664e1a1bd1
> 
> Sashiko flagged a problem with this:
> 
> https://sashiko.dev/#/patchset/20261013031943.489829-1-cochcoder%40proton.me
> 
> --
> Luiz Augusto von Dentz
>

[RFC PATCH v2] Bluetooth: L2CAP: tolerate zero-ident LE credit indications

[Kyle Pepper]

Tolerate exact-size, nonzero credit grants with identifier zero only
for connected LE credit-based channels. Keep the target and pending
security checks shared with ordinary identifiers. Do not send a
response with identifier zero or relax other signaling commands.

This is an interoperability exception to Core Vol 3 Part A section 4,
not a conformance fix.

Assisted-by: OpenCode:gpt-6.1-sol
Signed-off-by: Kyle Pepper <cochcoder@proton.me>
---
Changes since v1:
- Depend on the separately submitted target/state and pending-security fix.
- Require a connected ordinary LE CoC, an exact-size indication and a nonzero
  grant. Keep fixed/unready targets and ECRED identifier-zero grants excluded.
- Preserve shared target/security checks for normal and zero identifiers.
- Do not generate any response with identifier zero or relax other commands.

REQUIRED security dependency, submitted separately and not resent here:
https://lore.kernel.org/linux-bluetooth/20261015052018.129971-1-cochcoder@proton.me/
Signed dependency commit: 61a7ca610078ddf616873e7d4914cb6ac9eae7a3.
Apply it first. This mail includes its prerequisite patch-id against upstream
397464709a20. The resulting source tree matches the validated refreshed pair.

The Core specification still forbids identifier zero. This remains an
interoperability RFC requiring maintainer policy agreement, not a conformance
fix. The separate security patch is independently useful without this exception.

Fresh current-base controls: all nine focused security cases pass with either
security-only or combined kernels. Public credit controls pass 13/14 with
security-only (expected positive zero-ID failure), and 14/14 with this revision
added. No skips or captured KASAN/lockdep alerts occurred in these focused runs.
GCC W=1 changed objects and source-extracted security/target/zero-ID fixtures pass.

The refreshed full suite is NOT claimed passing: SCI Fast Mode encounters an
invalid response length for HCI opcode 0x20a3 and times out without a complete
summary. The same SCI failure reproduces on unpatched current upstream and both
revised guests. Initial spaced VM selectors selected broader tests; corrected
space-free credit runs are the focused results above. Earlier 134/134 combined
results belong to the older reference base, not this fresh full-suite attempt.

The combined Arch integration is reported working on hardware, not isolated
attribution or exhaustive device/security/teardown coverage. No remote CI pass
or severity claim is made. Private security reproducer/logs are not included.
Confirm archive rendering of the dependency link before sending.

 net/bluetooth/l2cap_core.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 7a7f30531..d805b1c62 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5396,6 +5396,10 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
 	     chan->mode != L2CAP_MODE_EXT_FLOWCTL))
 		goto unlock;
 
+	/* Tolerate identifier-zero credits only for a live LE CoC. */
+	if (!cmd->ident && (!credits || chan->mode != L2CAP_MODE_LE_FLOWCTL))
+		goto unlock;
+
 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
 	if (credits > max_credits) {
 		BT_ERR("LE credits overflow");
@@ -5994,11 +5998,21 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
 
 	BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
 
-	if (len != skb->len || !cmd->ident) {
+	if (len != skb->len) {
 		BT_DBG("corrupted command");
 		goto drop;
 	}
 
+	if (!cmd->ident) {
+		if (cmd->code != L2CAP_LE_CREDITS ||
+		    len != sizeof(struct l2cap_le_credits))
+			goto drop;
+
+		/* Credits have no response or identifier-matched transaction. */
+		l2cap_le_credits(conn, cmd, len, skb->data);
+		goto drop;
+	}
+
 	err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
 	if (err) {
 		struct l2cap_cmd_rej_unk rej;

base-commit: 397464709a204da9b8dc3b01d6ea42539d951cd2
prerequisite-patch-id: 658bb8f3b3e38bbbb21f2619434affc641582b7f

[RFC PATCH v3 1/2] Bluetooth: L2CAP: Keep credits from completing security upgrades

[Kyle Pepper]

Credit indications can invoke resume on fixed or unready channels.
Connected LE credit-based sockets can also resume during a security
upgrade because credits and security share the socket suspend flag.

Validate the target mode and state for every identifier. Track pending
LE/ECRED security upgrades and retain credits without sending queued
data or resuming the socket until encryption meets the requested level.
Drain queued data after security completes and keep credit-starved
sockets suspended.

Fixes: fad5fc89594d ("Bluetooth: Add LE flow control discipline")
Assisted-by: OpenCode:gpt-6.1-sol
Signed-off-by: Kyle Pepper <cochcoder@proton.me>
---
Changes since the standalone security submission:
- Wrap test notes to fix the GitLint B1 failures in series 1186119.
- Refresh onto bluetooth-next ff8b09806b7b without a source delta.
- Include this prerequisite as patch 1/2 of the credit RFC v3 series.

This security fix is independently useful. It does not accept identifier
zero and can be considered without patch 2. The series uses an RFC prefix
because patch 2 still requires agreement on a specification exception.
Do not queue the dependent patch alone before this prerequisite lands.

The saved standalone CI report lists every job except GitLint passing,
including the native L2CAP tester. This is not a CI result for this series.

Earlier local runs on 397464709a20: nine focused security controls pass
on security-only and combined guests. The 14 public credit controls pass
13/14 security-only (expected positive zero-ID failure), 14/14 combined.
There were no skips or captured kernel alerts in these focused runs.
GCC W=1 changed objects and source-extracted fixtures also passed there.

That base's full local attempt was incomplete: SCI Fast Mode timed out
after an invalid HCI response length for opcode 0x20a3. The same failure
reproduced unpatched; this patch does not claim to fix it. Initial spaced
VM filters selected broader tests; corrected space-free focused runs are
the results above. Historical older-base results of 133/134 and 134/134
are not fresh full-suite results for this series.

The combined Arch trial is reported working, not isolated security or
exhaustive lifetime coverage. No severity/CVE claim is made. The private
reproducer and detailed private regression logs remain excluded.

 net/bluetooth/l2cap_core.c | 33 +++++++++++++++++++++++++++++++--
 net/bluetooth/l2cap_sock.c |  9 +++++++--
 2 files changed, 38 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 4dd56e007..7a7f30531 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5391,6 +5391,11 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
 
 	l2cap_chan_lock(chan);
 
+	if (chan->state != BT_CONNECTED ||
+	    (chan->mode != L2CAP_MODE_LE_FLOWCTL &&
+	     chan->mode != L2CAP_MODE_EXT_FLOWCTL))
+		goto unlock;
+
 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
 	if (credits > max_credits) {
 		BT_ERR("LE credits overflow");
@@ -5404,6 +5409,9 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
 
 	chan->tx_credits += credits;
 
+	if (test_bit(FLAG_PENDING_SECURITY, &chan->flags))
+		goto unlock;
+
 	/* Resume sending */
 	l2cap_le_flowctl_send(chan);
 
@@ -7967,6 +7975,8 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 	mutex_lock(&conn->lock);
 
 	list_for_each_entry(chan, &conn->chan_l, list) {
+		bool pending_le;
+
 		l2cap_chan_lock(chan);
 
 		lockdep_assert_held(&chan->conn->lock);
@@ -7974,7 +7984,12 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 		BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
 		       state_to_string(chan->state));
 
-		if (!status && encrypt)
+		pending_le = hcon->type == LE_LINK &&
+			     (chan->mode == L2CAP_MODE_LE_FLOWCTL ||
+			      chan->mode == L2CAP_MODE_EXT_FLOWCTL) &&
+			     test_bit(FLAG_PENDING_SECURITY, &chan->flags);
+
+		if (!status && encrypt && !pending_le)
 			chan->sec_level = hcon->sec_level;
 
 		if (!__l2cap_no_conn_pending(chan)) {
@@ -7984,7 +7999,21 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 
 		if (!status && (chan->state == BT_CONNECTED ||
 				chan->state == BT_CONFIG)) {
-			chan->ops->resume(chan);
+			if (pending_le) {
+				if (!encrypt ||
+				    !smp_sufficient_security(hcon, chan->sec_level,
+							    SMP_ALLOW_STK)) {
+					l2cap_chan_unlock(chan);
+					continue;
+				}
+
+				clear_bit(FLAG_PENDING_SECURITY, &chan->flags);
+				chan->sec_level = hcon->sec_level;
+				l2cap_le_flowctl_send(chan);
+			}
+
+			if (!pending_le || chan->tx_credits)
+				chan->ops->resume(chan);
 			l2cap_check_encryption(chan, encrypt);
 			l2cap_chan_unlock(chan);
 			continue;
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index c396987c5..2d7f2935c 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -993,10 +993,15 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 		} else if ((sk->sk_state == BT_CONNECT2 &&
 			    test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 			   sk->sk_state == BT_CONNECTED) {
-			if (!l2cap_chan_check_security(chan, true))
+			if (!l2cap_chan_check_security(chan, true)) {
+				if (conn->hcon->type == LE_LINK &&
+				    (chan->mode == L2CAP_MODE_LE_FLOWCTL ||
+				     chan->mode == L2CAP_MODE_EXT_FLOWCTL))
+					set_bit(FLAG_PENDING_SECURITY, &chan->flags);
 				set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
-			else
+			} else {
 				sk->sk_state_change(sk);
+			}
 		} else {
 			err = -EINVAL;
 		}

base-commit: ff8b09806b7b18884ad8d3a2b3d702da534a4e21

[RFC PATCH v3 2/2] Bluetooth: L2CAP: tolerate zero-ident LE credit indications

[Kyle Pepper]

Tolerate exact-size, nonzero credit grants with identifier zero only
for connected LE credit-based channels. Keep the target and pending
security checks shared with ordinary identifiers. Do not send a
response with identifier zero or relax other signaling commands.

This is an interoperability exception to Core Vol 3 Part A section 4,
not a conformance fix.

Assisted-by: OpenCode:gpt-6.1-sol
Signed-off-by: Kyle Pepper <cochcoder@proton.me>
---
Changes since v2:
- Include the unchanged security prerequisite as patch 1/2 in this series,
  rather than relying on CI to apply a separately submitted dependency.
- Refresh onto bluetooth-next ff8b09806b7b without a source delta.
- Wrap test notes to keep all prose within GitLint's 80-column limit.

The saved v2 report failed application at l2cap_core.c:5396. That patch
depends on the security fix, which was not yet upstream. A dependency
link and prerequisite-patch-id did not make that CI run apply it first.
Apply this entire series in order; patch 2 alone is not a valid input.

The Core specification still forbids identifier zero. This remains an
interoperability RFC requiring maintainer policy agreement, not a
conformance fix. Patch 1 is independently useful without this exception.

Earlier 397464709a20 runs passed all nine focused security controls with
security-only and combined guests. Public credit controls passed 13/14
security-only (expected positive zero-ID failure), 14/14 combined, with
no skips or captured kernel alerts. Source-extracted fixtures and GCC
W=1 changed objects passed. These are prior runs, not fresh v3 VMs.

The earlier full-suite attempt was incomplete due to an SCI timeout also
seen on the unpatched base. No fresh full-suite or remote CI pass is
claimed for v3. The combined Arch trial is reported working on hardware,
not isolated attribution or exhaustive device/security/teardown coverage.
Private security reproducer/logs and the archived BlueZ test companion
are excluded. This series contains only the two kernel patches.

 net/bluetooth/l2cap_core.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 7a7f30531..d805b1c62 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5396,6 +5396,10 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
 	     chan->mode != L2CAP_MODE_EXT_FLOWCTL))
 		goto unlock;
 
+	/* Tolerate identifier-zero credits only for a live LE CoC. */
+	if (!cmd->ident && (!credits || chan->mode != L2CAP_MODE_LE_FLOWCTL))
+		goto unlock;
+
 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
 	if (credits > max_credits) {
 		BT_ERR("LE credits overflow");
@@ -5994,11 +5998,21 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
 
 	BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
 
-	if (len != skb->len || !cmd->ident) {
+	if (len != skb->len) {
 		BT_DBG("corrupted command");
 		goto drop;
 	}
 
+	if (!cmd->ident) {
+		if (cmd->code != L2CAP_LE_CREDITS ||
+		    len != sizeof(struct l2cap_le_credits))
+			goto drop;
+
+		/* Credits have no response or identifier-matched transaction. */
+		l2cap_le_credits(conn, cmd, len, skb->data);
+		goto drop;
+	}
+
 	err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
 	if (err) {
 		struct l2cap_cmd_rej_unk rej;