michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: L2CAP: Limit segments to TX MPS

Browse source 
le_data buffers are no longer limited to the minimun of 23 bytes, instead
it uses CONFIG_BLUETOOTH_L2CAP_IN_MTU which means it can be bigger than
the MPS thus causing invalid data to be sent:

> ACL Data RX: Handle 64 flags 0x02 dlen 18
      LE L2CAP: LE Connection Request (0x14) ident 1 len 10
        PSM: 128 (0x0080)
        Source CID: 64
        MTU: 672
        MPS: 23
        Credits: 65535
< ACL Data TX: Handle 64 flags 0x00 dlen 18
      LE L2CAP: LE Connection Response (0x15) ident 1 len 10
        Destination CID: 64
        MTU: 230
        MPS: 65
        Credits: 4
        Result: Connection successful (0x0000)
< ACL Data TX: Handle 64 flags 0x00 dlen 27
< ACL Data TX: Handle 64 flags 0x01 dlen 2
      Channel: 64 len 25 [PSM 128 mode 0] {chan 0}
        3c 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff  <...............
        ff ff ff ff ff ff ff ff ff

JIRA: ZEP-1219

Change-Id: Id67f1faac8766c66aa24c7421d44112434666a10
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Luiz Augusto von Dentz 2016-11-07 14:01:13 +02:00 • committed by Johan Hedberg
commit 3808ad0a96
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
subsys/bluetooth/host/l2cap.c
View file

@ -1614,7 +1614,8 @@ segment:
net_buf_add_le16(seg, net_buf_frags_len(buf));
}
len = min(min(buf->len, BT_L2CAP_MAX_LE_MPS - sdu_hdr_len), ch->tx.mps);
/* Don't send more that TX MPS including SDU length */
len = min(buf->len, ch->tx.mps - sdu_hdr_len);
memcpy(net_buf_add(seg, len), buf->data, len);
net_buf_pull(buf, len);