]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
authorChristian Eggers <ceggers@arri.de>
Wed, 25 Feb 2026 17:07:27 +0000 (18:07 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 25 Mar 2026 10:08:52 +0000 (11:08 +0100)
commitca97abddf1968659d497cf3037731eb87a6a803c
treec4679c43c63d18f4642ee68cac489e3907144ccb
parentab0b2de04d8de160c43eab65c49deb6aca650778
Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU

[ Upstream commit b6a2bf43aa37670432843bc73ae2a6288ba4d6f8 ]

Core 6.0, Vol 3, Part A, 3.4.3:
"... If the sum of the payload sizes for the K-frames exceeds the
specified SDU length, the receiver shall disconnect the channel."

This fixes L2CAP/LE/CFC/BV-27-C (running together with 'l2test -r -P
0x0027 -V le_public').

Fixes: aac23bf63659 ("Bluetooth: Implement LE L2CAP reassembly")
Signed-off-by: Christian Eggers <ceggers@arri.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/bluetooth/l2cap_core.c