[Backport ncs-v3.1-branch] [nrf fromlist] Bluetooth: Host: Add req/rsp l2cap validation #3177
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
L2CAP channels will now, along with the ident, store the opcode of the pending request. This commit expands the ident lookup function to also compare received response types to this opcode, and will ignore unsolicited responses. Setting of idents for channels are moved after verification of buffer allocation for the request to be sent. A TODO is added for improving this functionality at a later time. Upstream PR #: 94080 Signed-off-by: Håvard Reierstad <[email protected]> (cherry picked from commit 7f14815)
PavelVPV
approved these changes
Aug 8, 2025
There was a problem hiding this comment.
Pull Request Overview
This PR backports a security improvement that adds request/response validation to L2CAP (Logical Link Control and Adaptation Protocol) channels in the Bluetooth host stack. The change enhances the validation mechanism to match responses with their corresponding requests by tracking the pending request opcode.
- Adds a new
pending_reqfield to track the opcode of pending L2CAP requests - Updates the identifier lookup mechanism to validate both identifier and request opcode
- Improves response validation by ensuring responses match the expected request type
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| subsys/bluetooth/host/l2cap.c | Implements request/response validation by adding opcode tracking and updating lookup functions |
| include/zephyr/bluetooth/l2cap.h | Adds pending_req field to bt_l2cap_le_chan structure for tracking request opcodes |
alwa-nordic
approved these changes
Aug 8, 2025
|
none Note: This comment is automatically posted and updated by the Contribs GitHub Action. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport 7f14815 from #3174.