[PATCH bluetooth-next] Bluetooth: L2CAP: validate MPS and MTU in ECRED connection response

[PATCH bluetooth-next] Bluetooth: L2CAP: validate MPS and MTU in ECRED connection response

[Joas Antonio dos Santos via B4 Relay]

From: Joas Antonio dos Santos <joasantonio108@gmail.com>

l2cap_ecred_conn_rsp() does not validate the MPS and MTU values from
the peer before storing them. All other L2CAP connection paths
(le_connect_req/rsp, ecred_conn_req, ecred_reconf_req) validate these
values against minimums, but the ECRED connection response handler
assigns them directly to chan->remote_mps and chan->omtu.

When a malicious or buggy peer sends MPS=0, l2cap_segment_le_sdu()
computes pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE, which
underflows the u16, leading to an oversized skb allocation and
potential memory corruption.

Add the same MPS >= L2CAP_ECRED_MIN_MPS and MTU >= L2CAP_ECRED_MIN_MTU
checks that l2cap_ecred_conn_req() already applies, refusing the
channel if the values are below spec minimums.

Found by LLM-assisted manual code review.

Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
---
 net/bluetooth/l2cap_core.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 4dd56e007..c3b8f0f46 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5711,6 +5711,16 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
 				break;
 			}
 
+			/*
+			 * Validate MPS and MTU per BT Core Spec
+			 * Vol 3 Part A Sec 10.2
+			 */
+			if (mtu < L2CAP_ECRED_MIN_MTU ||
+			    mps < L2CAP_ECRED_MIN_MPS) {
+				l2cap_chan_del(chan, ECONNREFUSED);
+				break;
+			}
+
 			chan->ident = 0;
 			chan->dcid = dcid;
 			chan->omtu = mtu;

---
base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
change-id: 20261108-bt-ecred-mps-fix-a5f18dc06329

Best regards,
-- 
Joas Antonio dos Santos <joasantonio108@gmail.com>