Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit df3c3931 authored by Johan Hedberg's avatar Johan Hedberg Committed by Gustavo Padovan
Browse files

Bluetooth: Fix accepting connect requests for defer_setup 



When authentication completes we shouldn't blindly accept any pending
L2CAP connect requests. If the socket has the defer_setup feature
enabled it should still wait for user space acceptance of the connect
request. The issue only happens for non-SSP connections since with SSP
the L2CAP Connect request may not be sent for non-SDP PSMs before
authentication has completed successfully.

Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: default avatarGustavo F. Padovan <padovan@profusion.mobi>
parent 6fdf658c

net/bluetooth/l2cap_core.c

+15 −6
Original line number Diff line number Diff line
@@ -4002,21 +4002,30 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) 
			}

		} else if (sk->sk_state == BT_CONNECT2) {

			struct l2cap_conn_rsp rsp;

			__u16 result;

			__u16 res, stat;



			if (!status) {

				if (bt_sk(sk)->defer_setup) {

					struct sock *parent = bt_sk(sk)->parent;

					res = L2CAP_CR_PEND;

					stat = L2CAP_CS_AUTHOR_PEND;

					parent->sk_data_ready(parent, 0);

				} else {

					sk->sk_state = BT_CONFIG;

				result = L2CAP_CR_SUCCESS;

					res = L2CAP_CR_SUCCESS;

					stat = L2CAP_CS_NO_INFO;

				}

			} else {

				sk->sk_state = BT_DISCONN;

				l2cap_sock_set_timer(sk, HZ / 10);

				result = L2CAP_CR_SEC_BLOCK;

				res = L2CAP_CR_SEC_BLOCK;

				stat = L2CAP_CS_NO_INFO;

			}



			rsp.scid   = cpu_to_le16(chan->dcid);

			rsp.dcid   = cpu_to_le16(chan->scid);

			rsp.result = cpu_to_le16(result);

			rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);

			rsp.result = cpu_to_le16(res);

			rsp.status = cpu_to_le16(stat);

			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,

							sizeof(rsp), &rsp);

		}