host/l2cap: send command reject in L2CAP disc req for invalid CID
If ble_hs_conn_chan_find_by_scid fails to find channel, it means
that destination CID in L2CAP Disconnection Request is invalid.
Send L2CAP_COMMAND_REJECT_RSP with BLE_L2CAP_SIG_ERR_INVALID_CID
reason.
This is affecting L2CAP/LE/CFC/BV-23-C
@@ -1552,7 +1552,13 @@ ble_l2cap_sig_disc_req_rx(uint16_t conn_handle, struct ble_l2cap_sig_hdr *hdr,
* is from peer perspective. It is source CID from nimble perspective
*/
chan = ble_hs_conn_chan_find_by_scid(conn, le16toh(req->dcid));
- if (!chan || (le16toh(req->scid) != chan->dcid)) {
+ if (!chan) {
+ os_mbuf_free_chain(txom);
+ ble_hs_unlock();
+ ble_l2cap_sig_reject_invalid_cid_tx(conn_handle, hdr->identifier, req->dcid, req->scid);
+ return 0;
+ }
+ if (le16toh(req->scid) != chan->dcid) {
os_mbuf_free_chain(txom);
ble_hs_unlock();
return 0;
