Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9b7b18ef authored by Johan Hedberg's avatar Johan Hedberg Committed by Marcel Holtmann
Browse files

Bluetooth: Fix SMP error and response to be mutually exclusive 



Returning failure from the SMP data parsing function will cause an
immediate disconnect, making any attempts to send a response PDU futile.
This patch updates the function to always either send a response or
return an error, but never both at the same time:

* In the case that HCI_LE_ENABLED is not set we want to send a Pairing Not
  Supported response but it is not required to force a disconnection, so
  do not set the error return in this case.

* If we get garbage SMP data we can just fail with the handler function
  instead of also trying to send an SMP Failure PDU.

* There's no reason to force a disconnection if we receive an unknown SMP
  command. Instead simply send a proper Command Not Supported SMP
  response.

Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent b04afa0c

net/bluetooth/smp.c

+5 −8
Original line number Original line Diff line number Diff line
@@ -1430,7 +1430,6 @@ static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb) 
		return -EILSEQ;

		return -EILSEQ;





	if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {

	if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {

		err = -EOPNOTSUPP;

		reason = SMP_PAIRING_NOTSUPP;

		reason = SMP_PAIRING_NOTSUPP;

		goto done;

		goto done;

	}

	}
@@ -1447,7 +1446,6 @@ static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb) 
	if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&

	if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&

	    !test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {

	    !test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {

		BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);

		BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);

		reason = SMP_CMD_NOTSUPP;

		err = -EOPNOTSUPP;

		err = -EOPNOTSUPP;

		goto done;

		goto done;

	}

	}
@@ -1459,7 +1457,6 @@ static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb) 




	case SMP_CMD_PAIRING_FAIL:

	case SMP_CMD_PAIRING_FAIL:

		smp_failure(conn, 0);

		smp_failure(conn, 0);

		reason = 0;

		err = -EPERM;

		err = -EPERM;

		break;

		break;
@@ -1501,17 +1498,17 @@ static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb) 




	default:

	default:

		BT_DBG("Unknown command code 0x%2.2x", code);

		BT_DBG("Unknown command code 0x%2.2x", code);



		reason = SMP_CMD_NOTSUPP;

		reason = SMP_CMD_NOTSUPP;

		err = -EOPNOTSUPP;

		goto done;

		goto done;

	}

	}





done:

done:

	if (!err) {

		if (reason)

		if (reason)

			smp_failure(conn, reason);

			smp_failure(conn, reason);

	if (!err)

		kfree_skb(skb);

		kfree_skb(skb);

	}



	return err;

	return err;

}

}