Skip to content

Conversation

@Frozen935
Copy link
Contributor

Rootcause: the dynamic L2CAP channel rx.cid is not reset, it will be intercepted by the judgment condition of the fixed channel, directly using the last alloced cid may cause cid conflict.

For example, the first BR L2CAP channel is an SDP service, and the chan requested from bt_sdp_pool occupies cid 0x40. When the sdp connection is disconnected, it will be removed from the conn->channels list, but the bt_sdp_pool[0] cid field is not cleanup. A new service request may be A2DP or HFP, which will request cid 0x40. When the next sdp service request is received, the chan rx.cid received will not be 0, and this chan will be used directly instead of dynamically requesting a new cid, which will cause a cid conflict.

@Frozen935 Frozen935 marked this pull request as ready for review August 19, 2025 12:59
@zephyrbot zephyrbot added size: XS A PR changing only a single line of code area: Bluetooth Classic Bluetooth Classic (BR/EDR) area: Bluetooth labels Aug 19, 2025
rootcause: The dynamic L2CAP channel rx.cid is not reset, it
will be intercepted by the judgment condition of the fixed channel,
directly using the last alloced cid may cause cid conflict.

Signed-off-by: zhenwei fang <fangzhenwei@bytedance.com>
@sonarqubecloud
Copy link

bt_l2cap_br_chan_set_state(chan, BT_L2CAP_DISCONNECTED);
BR_CHAN(chan)->psm = 0U;
if (L2CAP_BR_CID_IS_DYN(BR_CHAN(chan)->rx.cid)) {
BR_CHAN(chan)->rx.cid = 0U;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

need to reset all rx bt_l2cap_br_endpoint?

will tx enpoint be the potential problems?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tx enpoint don't need

@Frozen935 Frozen935 closed this Aug 20, 2025
@lylezhu2012
Copy link
Contributor

@Frozen935 , Why did you close this PR?

@Frozen935
Copy link
Contributor Author

@Frozen935 , Why did you close this PR?

CI build break, and I force pushed the rebase, this PR can't reopen.

I will submit a new PR later.

@lylezhu2012
Copy link
Contributor

I crated a #98473 for the changes of this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: Bluetooth Classic Bluetooth Classic (BR/EDR) area: Bluetooth size: XS A PR changing only a single line of code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants