7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Siwei Zhang [ Upstream commit 226fa3b676cbf2236f803bccd347462433ffc2c8 ] L2CAP_OPTIONS accepts a txwin_size of zero and stores it in tx_win. The zero is then sent to the peer in our configuration request, and if the channel ends up in ERTM mode it is passed to l2cap_seq_list_init(). Use the default TxWindow instead, as the mode can still be changed to ERTM during configuration. Fixes: 14b5aa71ec50 ("Bluetooth: Add sockopt configuration for txWindow on L2CAP") Cc: stable@vger.kernel.org Signed-off-by: Siwei Zhang Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Sasha Levin --- net/bluetooth/l2cap_sock.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 38aedd7b00d33..1eab4478abf4a 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -815,6 +815,10 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, break; } + /* A zero TxWindow is invalid, use the default instead */ + if (!opts.txwin_size) + opts.txwin_size = L2CAP_DEFAULT_TX_WINDOW; + if (!l2cap_valid_mtu(chan, opts.imtu)) { err = -EINVAL; break; -- 2.53.0