diff options
| author |   Zhenghang Xiao <kipreyyy@gmail.com> | 2026-05-26 18:51:52 +0800 |
|---|---|---|
| committer |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-05-28 08:52:13 -0400 |
| commit | 00e1950716c6ed67d74777b2db286b0fa23b4be9 (patch) | |
| tree | 3a85cdcfc974bba5649c7f9e7c0bfc41cc98a36a /tools/perf/arch/s390/git:/ssh:/git@git.zx2c4.com | |
| parent | Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading (diff) | |
Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
l2cap_ecred_reconf_rsp() returns early on success without clearing
chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp,
l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a
successful transaction to prevent the channel from matching subsequent
responses with the recycled ident value.
A remote attacker that completed a reconfiguration as the peer can
replay a failure response with the stale ident, causing the kernel to
match and destroy the already-established channel via
l2cap_chan_del(chan, ECONNRESET).
Clear chan->ident for all matching channels on success, and harden the
failure path by using l2cap_chan_hold_unless_zero() consistent with
other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).
Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'tools/perf/arch/s390/git:/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions