[PATCH] Bluetooth: L2CAP: Fix size check for receive buffer space

[PATCH] Bluetooth: L2CAP: Fix size check for receive buffer space

[Amir Abudubai]

Check that available receive space covers a full MTU-sized SDU and its
overhead, rather than just the overhead. Otherwise, credits can be
exhausted before an SDU is completed. This could result in a deadlock under
some configurations and SDU combinations.

This follows the SDU-sized credit policy from commit 96cd8eaa131f
("Bluetooth: L2CAP: Derive rx credits from MTU and MPS"). Clarify the
comment by replacing "packet" with "SDU".

Fixes: ce60b9231b66 ("Bluetooth: compute LE flow credits based on recvbuf space")
Signed-off-by: Amir Abudubai <amirabudubai@gmail.com>
---
The exact SDU length that causes a deadlock depends on build and configuration.
On my machine, 13090-byte SDUs caused deadlocks and this patch fixed it.

AI assistance: OpenCode/GPT-6 Astra for testing and analysis.

 net/bluetooth/l2cap_sock.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 7a2551ef7f50..8603e63defb5 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1229,11 +1229,11 @@ static void l2cap_publish_rx_avail(struct l2cap_chan *chan)
 
 	/* Correct available memory by estimated sk_buff overhead.
 	 * This is significant due to small transfer sizes. However, accept
-	 * at least one full packet if receive space is non-zero.
+	 * at least one full SDU if receive space is non-zero.
 	 */
 	expected_skbs = DIV_ROUND_UP(avail, chan->mps);
 	skb_overhead = expected_skbs * sizeof(struct sk_buff);
-	if (skb_overhead < avail)
+	if (avail - skb_overhead >= chan->imtu + L2CAP_SDULEN_SIZE)
 		l2cap_chan_rx_avail(chan, avail - skb_overhead);
 	else
 		l2cap_chan_rx_avail(chan, -1);

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb