Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 79820a7e authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz Committed by Greg Kroah-Hartman
Browse files

Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST 

[ Upstream commit 7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865 ]

If we received HCI_EV_IO_CAPA_REQUEST while
HCI_OP_READ_REMOTE_EXT_FEATURES is yet to be responded assume the remote
does support SSP since otherwise this event shouldn't be generated.

Link: https://lore.kernel.org/linux-bluetooth/CABBYNZ+9UdG1cMZVmdtN3U2aS16AKMCyTARZZyFX7xTEDWcMOw@mail.gmail.com/T/#t


Fixes: c7f59461f5a7 ("Bluetooth: Fix a refcnt underflow problem for hci_conn")
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 98fb98fd

net/bluetooth/hci_event.c

+4 −1
Original line number Diff line number Diff line
@@ -4469,9 +4469,12 @@ static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb) 
	hci_dev_lock(hdev);



	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);

	if (!conn || !hci_conn_ssp_enabled(conn))

	if (!conn || !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))

		goto unlock;



	/* Assume remote supports SSP since it has triggered this event */

	set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);



	hci_conn_hold(conn);



	if (!hci_dev_test_flag(hdev, HCI_MGMT))