From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756902AbaFIJLk (ORCPT ); Mon, 9 Jun 2014 05:11:40 -0400 Received: from ip4-83-240-18-248.cust.nbox.cz ([83.240.18.248]:58430 "EHLO ip4-83-240-18-248.cust.nbox.cz" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754887AbaFIIvZ (ORCPT ); Mon, 9 Jun 2014 04:51:25 -0400 From: Jiri Slaby To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Johan Hedberg , Marcel Holtmann , Jiri Slaby Subject: [PATCH 3.12 063/146] Bluetooth: Fix triggering BR/EDR L2CAP Connect too early Date: Mon, 9 Jun 2014 10:49:58 +0200 Message-Id: <933d4bfa946ca681b33ff29b4994887c5787968a.1402303821.git.jslaby@suse.cz> X-Mailer: git-send-email 1.9.3 In-Reply-To: References: In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Johan Hedberg 3.12-stable review patch. If anyone has any objections, please let me know. =============== commit 9eb1fbfa0a737fd4d3a6d12d71c5ea9af622b887 upstream. Commit 1c2e004183178 introduced an event handler for the encryption key refresh complete event with the intent of fixing some LE/SMP cases. However, this event is shared with BR/EDR and there we actually want to act only on the auth_complete event (which comes after the key refresh). If we do not do this we may trigger an L2CAP Connect Request too early and cause the remote side to return a security block error. Signed-off-by: Johan Hedberg Signed-off-by: Marcel Holtmann Signed-off-by: Jiri Slaby --- net/bluetooth/hci_event.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index a3af2b750e96..2eeb6643d78a 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -2993,6 +2993,12 @@ static void hci_key_refresh_complete_evt(struct hci_dev *hdev, if (!conn) goto unlock; + /* For BR/EDR the necessary steps are taken through the + * auth_complete event. + */ + if (conn->type != LE_LINK) + goto unlock; + if (!ev->status) conn->sec_level = conn->pending_sec_level; -- 1.9.3