| From 17378447f79d3cff1ba494a3be7fd31f2611a928 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 12 Mar 2020 12:35:27 +0800 |
| Subject: Bluetooth: L2CAP: handle l2cap config request during open state |
| |
| From: Howard Chung <howardchung@google.com> |
| |
| [ Upstream commit 96298f640104e4cd9a913a6e50b0b981829b94ff ] |
| |
| According to Core Spec Version 5.2 | Vol 3, Part A 6.1.5, |
| the incoming L2CAP_ConfigReq should be handled during |
| OPEN state. |
| |
| The section below shows the btmon trace when running |
| L2CAP/COS/CFD/BV-12-C before and after this change. |
| |
| === Before === |
| ... |
| > ACL Data RX: Handle 256 flags 0x02 dlen 12 #22 |
| L2CAP: Connection Request (0x02) ident 2 len 4 |
| PSM: 1 (0x0001) |
| Source CID: 65 |
| < ACL Data TX: Handle 256 flags 0x00 dlen 16 #23 |
| L2CAP: Connection Response (0x03) ident 2 len 8 |
| Destination CID: 64 |
| Source CID: 65 |
| Result: Connection successful (0x0000) |
| Status: No further information available (0x0000) |
| < ACL Data TX: Handle 256 flags 0x00 dlen 12 #24 |
| L2CAP: Configure Request (0x04) ident 2 len 4 |
| Destination CID: 65 |
| Flags: 0x0000 |
| > HCI Event: Number of Completed Packets (0x13) plen 5 #25 |
| Num handles: 1 |
| Handle: 256 |
| Count: 1 |
| > HCI Event: Number of Completed Packets (0x13) plen 5 #26 |
| Num handles: 1 |
| Handle: 256 |
| Count: 1 |
| > ACL Data RX: Handle 256 flags 0x02 dlen 16 #27 |
| L2CAP: Configure Request (0x04) ident 3 len 8 |
| Destination CID: 64 |
| Flags: 0x0000 |
| Option: Unknown (0x10) [hint] |
| 01 00 .. |
| < ACL Data TX: Handle 256 flags 0x00 dlen 18 #28 |
| L2CAP: Configure Response (0x05) ident 3 len 10 |
| Source CID: 65 |
| Flags: 0x0000 |
| Result: Success (0x0000) |
| Option: Maximum Transmission Unit (0x01) [mandatory] |
| MTU: 672 |
| > HCI Event: Number of Completed Packets (0x13) plen 5 #29 |
| Num handles: 1 |
| Handle: 256 |
| Count: 1 |
| > ACL Data RX: Handle 256 flags 0x02 dlen 14 #30 |
| L2CAP: Configure Response (0x05) ident 2 len 6 |
| Source CID: 64 |
| Flags: 0x0000 |
| Result: Success (0x0000) |
| > ACL Data RX: Handle 256 flags 0x02 dlen 20 #31 |
| L2CAP: Configure Request (0x04) ident 3 len 12 |
| Destination CID: 64 |
| Flags: 0x0000 |
| Option: Unknown (0x10) [hint] |
| 01 00 91 02 11 11 ...... |
| < ACL Data TX: Handle 256 flags 0x00 dlen 14 #32 |
| L2CAP: Command Reject (0x01) ident 3 len 6 |
| Reason: Invalid CID in request (0x0002) |
| Destination CID: 64 |
| Source CID: 65 |
| > HCI Event: Number of Completed Packets (0x13) plen 5 #33 |
| Num handles: 1 |
| Handle: 256 |
| Count: 1 |
| ... |
| === After === |
| ... |
| > ACL Data RX: Handle 256 flags 0x02 dlen 12 #22 |
| L2CAP: Connection Request (0x02) ident 2 len 4 |
| PSM: 1 (0x0001) |
| Source CID: 65 |
| < ACL Data TX: Handle 256 flags 0x00 dlen 16 #23 |
| L2CAP: Connection Response (0x03) ident 2 len 8 |
| Destination CID: 64 |
| Source CID: 65 |
| Result: Connection successful (0x0000) |
| Status: No further information available (0x0000) |
| < ACL Data TX: Handle 256 flags 0x00 dlen 12 #24 |
| L2CAP: Configure Request (0x04) ident 2 len 4 |
| Destination CID: 65 |
| Flags: 0x0000 |
| > HCI Event: Number of Completed Packets (0x13) plen 5 #25 |
| Num handles: 1 |
| Handle: 256 |
| Count: 1 |
| > HCI Event: Number of Completed Packets (0x13) plen 5 #26 |
| Num handles: 1 |
| Handle: 256 |
| Count: 1 |
| > ACL Data RX: Handle 256 flags 0x02 dlen 16 #27 |
| L2CAP: Configure Request (0x04) ident 3 len 8 |
| Destination CID: 64 |
| Flags: 0x0000 |
| Option: Unknown (0x10) [hint] |
| 01 00 .. |
| < ACL Data TX: Handle 256 flags 0x00 dlen 18 #28 |
| L2CAP: Configure Response (0x05) ident 3 len 10 |
| Source CID: 65 |
| Flags: 0x0000 |
| Result: Success (0x0000) |
| Option: Maximum Transmission Unit (0x01) [mandatory] |
| MTU: 672 |
| > HCI Event: Number of Completed Packets (0x13) plen 5 #29 |
| Num handles: 1 |
| Handle: 256 |
| Count: 1 |
| > ACL Data RX: Handle 256 flags 0x02 dlen 14 #30 |
| L2CAP: Configure Response (0x05) ident 2 len 6 |
| Source CID: 64 |
| Flags: 0x0000 |
| Result: Success (0x0000) |
| > ACL Data RX: Handle 256 flags 0x02 dlen 20 #31 |
| L2CAP: Configure Request (0x04) ident 3 len 12 |
| Destination CID: 64 |
| Flags: 0x0000 |
| Option: Unknown (0x10) [hint] |
| 01 00 91 02 11 11 ..... |
| < ACL Data TX: Handle 256 flags 0x00 dlen 18 #32 |
| L2CAP: Configure Response (0x05) ident 3 len 10 |
| Source CID: 65 |
| Flags: 0x0000 |
| Result: Success (0x0000) |
| Option: Maximum Transmission Unit (0x01) [mandatory] |
| MTU: 672 |
| < ACL Data TX: Handle 256 flags 0x00 dlen 12 #33 |
| L2CAP: Configure Request (0x04) ident 3 len 4 |
| Destination CID: 65 |
| Flags: 0x0000 |
| > HCI Event: Number of Completed Packets (0x13) plen 5 #34 |
| Num handles: 1 |
| Handle: 256 |
| Count: 1 |
| > HCI Event: Number of Completed Packets (0x13) plen 5 #35 |
| Num handles: 1 |
| Handle: 256 |
| Count: 1 |
| ... |
| |
| Signed-off-by: Howard Chung <howardchung@google.com> |
| Signed-off-by: Marcel Holtmann <marcel@holtmann.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/bluetooth/l2cap_core.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c |
| index de085947c19c2..5e3f5c1ba07d6 100644 |
| --- a/net/bluetooth/l2cap_core.c |
| +++ b/net/bluetooth/l2cap_core.c |
| @@ -4107,7 +4107,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, |
| return 0; |
| } |
| |
| - if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) { |
| + if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 && |
| + chan->state != BT_CONNECTED) { |
| cmd_reject_invalid_cid(conn, cmd->ident, chan->scid, |
| chan->dcid); |
| goto unlock; |
| -- |
| 2.25.1 |
| |
