linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [BUG 0 / 6] L2cap: Spec violations
@ 2022-11-18  3:52 Sungwoo Kim
  2022-11-18  3:55 ` [BUG 1 " Sungwoo Kim
                   ` (5 more replies)
  0 siblings, 6 replies; 7+ messages in thread
From: Sungwoo Kim @ 2022-11-18  3:52 UTC (permalink / raw)
  To: marcel
  Cc: johan.hedberg, luiz.dentz, davem, edumazet, kuba, pabeni,
	linux-bluetooth, netdev, linux-kernel

Hello,
Our fuzzer found six spec violations, illegal state transition.

1. BT_CONNECT2 -> BT_CONFIG by L2CAP_CONN_RSP
2. BT_CONNECT2 -> BT_CONNECTED by L2CAP_CONF_RSP
3. BT_CONNECT2 -> BT_DISCONN by L2CAP_CONF_RSP
4. BT_CONNECTED -> BT_CONFIG by L2CAP_CONN_RSP
5. BT_DISCONN -> BT_CONFIG by L2CAP_CONN_RSP
6. BT_DISCONN -> BT_CONNECTED by L2CAP_CONN_RSP

All expected behaviors are ignoring incoming packets as described in
the spec v5.3 | Vol 3, Part A 6. STATE MACHINE.
Also, I assumed BT_CONNECT2 is corresponding to WAIT_CONNECT in the spec.

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2022-11-18  4:05 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-18  3:52 [BUG 0 / 6] L2cap: Spec violations Sungwoo Kim
2022-11-18  3:55 ` [BUG 1 " Sungwoo Kim
2022-11-18  4:02 ` [BUG 2 " Sungwoo Kim
2022-11-18  4:02 ` [BUG 3 " Sungwoo Kim
2022-11-18  4:03 ` [BUG 4 " Sungwoo Kim
2022-11-18  4:03 ` [BUG 5 " Sungwoo Kim
2022-11-18  4:03 ` [BUG 6 " Sungwoo Kim

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).