Received: by 2002:a05:6358:d09b:b0:dc:cd0c:909e with SMTP id jc27csp33043rwb; Thu, 17 Nov 2022 19:54:56 -0800 (PST) X-Google-Smtp-Source: AA0mqf61U7kpq+coD3n3NRNQ294pQWutTd1et/1oTlzDlT/ju4WN2nCoSMCHLwopOOaonfoOfGKL X-Received: by 2002:a63:4081:0:b0:46f:e657:7d25 with SMTP id n123-20020a634081000000b0046fe6577d25mr4828823pga.347.1668743696080; Thu, 17 Nov 2022 19:54:56 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1668743696; cv=none; d=google.com; s=arc-20160816; b=FBtikMK15yxs7CHxXESfI1RjZlPuHghU8lfwr5J6XaFnjXPLipUitm6jcyc2pkuu4L dEaZ6Wbth2fQf8Qd8uTHIIGeJa8pNBH5K0TcX1ppVc81VtIqX9ZZmKONr30v8nITftHm TvjbR+9l7N/JC7VQgobbHb6kSTbqhVSE8TF1huxlG5ZQw3mmuBemct8/XgBHlSzO7AIY BLCRhFy0GLF3TEiyLQSPMwfGlQCGGlTws7NAGBxo4BLD2FevDus/PXSjky4jCe/5XgzG arVJ32FVnvxi3BODXtOPe72N4XCewWndEgy22ADFDK8wPcK3OsXDtipwzFFDEjdYLZnd CAtw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:subject:message-id:date:from:mime-version; bh=240kn03GT6YjtHcyHthMPHCmJ35FvTMvfiM7fDZi1UY=; b=imFojfoMN1rryPpMUZCY43jDxPM0FBmmvMtnakShXp5WNiMRQkihNTFze/DDKtEvH9 c7gKSojK88lME3CkTsaKESnobRjd1JiGAGjSoVq2E4rzJrkJBtHN2RW6dONuINgOkHvN xiG7LwP9YwqnLcsexqIhc13IUhtvbbJ+hEtk0Bf9J0lOiztzPJBGmOyW/oOqjCQtkm6K 4CHN9ACUsuw1c+7Ifbu2Fjq+qvAKGbm+pz12MjeIyjGec7XSxagO1vH+dBd/Q5n0KaC9 odt+jvWNx5mwFrhHpRWUCqEO2hONTAlsBHNo96Tn+zbImh5JDQgmIt0q2qpWD2Ui/qiu qs1Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-bluetooth-owner@vger.kernel.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id ng10-20020a17090b1a8a00b00202fd098892si2961471pjb.190.2022.11.17.19.54.43; Thu, 17 Nov 2022 19:54:56 -0800 (PST) Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-bluetooth-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231814AbiKRDwj (ORCPT + 99 others); Thu, 17 Nov 2022 22:52:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47514 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240679AbiKRDwi (ORCPT ); Thu, 17 Nov 2022 22:52:38 -0500 Received: from mail-lf1-f44.google.com (mail-lf1-f44.google.com [209.85.167.44]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BF93B8F3EE; Thu, 17 Nov 2022 19:52:36 -0800 (PST) Received: by mail-lf1-f44.google.com with SMTP id l12so6224504lfp.6; Thu, 17 Nov 2022 19:52:36 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=240kn03GT6YjtHcyHthMPHCmJ35FvTMvfiM7fDZi1UY=; b=HXB5p2gSHUHjSuEBF3tHIhzrTxo5W9omwZmVeg4rdcPQZZjDE7Wbddh7Na+I2fv8U/ uThoB0nYlvWmADbGepx+4QA5jkWMsFkeNZBUotwA/wuOFN8XORd1p7EMmTk48hB01LPz 2LmFnNiQSVdI0KEAbcFnKcAUf3cg0L8tq8egyvGqVCeQmb5wgj/Hv+DmPB9tm41JcUWi nz+4lA6W8BnDAPoA0NVK9faMlV4btC8fs/QlIU+F5qPiU3VmUIPWveKjy9Sc0EvzMt+b IPIy7yFzVGUs1HkBviKm+95WIesS7Cdv1qme4XjtNI7EDj1yYJLoXCH/1D0rccaXDvzD Ep7A== X-Gm-Message-State: ANoB5pmnMSNvk5Qp86g6u2BJ4F9rIbMqP8JTptB03kQ8ll9HxBtjmoZv x3uViv/1oqsULvrF6l8Fwpjthumk7oyz4aul X-Received: by 2002:a05:6512:298f:b0:4a2:4365:7da7 with SMTP id du15-20020a056512298f00b004a243657da7mr2099814lfb.639.1668743555021; Thu, 17 Nov 2022 19:52:35 -0800 (PST) Received: from mail-lf1-f47.google.com (mail-lf1-f47.google.com. [209.85.167.47]) by smtp.gmail.com with ESMTPSA id a25-20020a056512201900b00492dbf809e8sm470572lfb.118.2022.11.17.19.52.34 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 17 Nov 2022 19:52:34 -0800 (PST) Received: by mail-lf1-f47.google.com with SMTP id j4so6291383lfk.0; Thu, 17 Nov 2022 19:52:34 -0800 (PST) X-Received: by 2002:a05:6512:3ca4:b0:4b4:b5c2:647c with SMTP id h36-20020a0565123ca400b004b4b5c2647cmr1797642lfv.42.1668743554314; Thu, 17 Nov 2022 19:52:34 -0800 (PST) MIME-Version: 1.0 From: Sungwoo Kim Date: Thu, 17 Nov 2022 22:52:08 -0500 X-Gmail-Original-Message-ID: Message-ID: Subject: [BUG 0 / 6] L2cap: Spec violations To: marcel@holtmann.org Cc: johan.hedberg@gmail.com, luiz.dentz@gmail.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=-1.6 required=5.0 tests=BAYES_00, FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS, RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS, UPPERCASE_50_75 autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org Hello, Our fuzzer found six spec violations, illegal state transition. 1. BT_CONNECT2 -> BT_CONFIG by L2CAP_CONN_RSP 2. BT_CONNECT2 -> BT_CONNECTED by L2CAP_CONF_RSP 3. BT_CONNECT2 -> BT_DISCONN by L2CAP_CONF_RSP 4. BT_CONNECTED -> BT_CONFIG by L2CAP_CONN_RSP 5. BT_DISCONN -> BT_CONFIG by L2CAP_CONN_RSP 6. BT_DISCONN -> BT_CONNECTED by L2CAP_CONN_RSP All expected behaviors are ignoring incoming packets as described in the spec v5.3 | Vol 3, Part A 6. STATE MACHINE. Also, I assumed BT_CONNECT2 is corresponding to WAIT_CONNECT in the spec.