Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

linvjw · linvjw · commit 4c52d3d3fdef · 2013-02-04T16:40:07.000-05:00
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
@@ -249,12 +249,12 @@ static void hci_conn_disconnect(struct hci_conn *conn)
 	__u8 reason = hci_proto_disconn_ind(conn);
 
 	switch (conn->type) {
-	case ACL_LINK:
-		hci_acl_disconn(conn, reason);
-		break;
 	case AMP_LINK:
 		hci_amp_disconn(conn, reason);
 		break;
+	default:
+		hci_acl_disconn(conn, reason);
+		break;
 	}
 }
 
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
@@ -859,6 +859,19 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
 
 	skb_pull(skb, sizeof(code));
 
+	/*
+	 * The SMP context must be initialized for all other PDUs except
+	 * pairing and security requests. If we get any other PDU when
+	 * not initialized simply disconnect (done if this function
+	 * returns an error).
+	 */
+	if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
+	    !conn->smp_chan) {
+		BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
+		kfree_skb(skb);
+		return -ENOTSUPP;
+	}
+
 	switch (code) {
 	case SMP_CMD_PAIRING_REQ:
 		reason = smp_cmd_pairing_req(conn, skb);

Original file line number	Diff line number	Diff line change
`@@ -249,12 +249,12 @@ static void hci_conn_disconnect(struct hci_conn *conn)`
`249`	`249`	`__u8 reason = hci_proto_disconn_ind(conn);`
`250`	`250`
`251`	`251`	`switch (conn->type) {`
`252`		`- case ACL_LINK:`
`253`		`- hci_acl_disconn(conn, reason);`
`254`		`- break;`
`255`	`252`	`case AMP_LINK:`
`256`	`253`	`hci_amp_disconn(conn, reason);`
`257`	`254`	`break;`
	`255`	`+ default:`
	`256`	`+ hci_acl_disconn(conn, reason);`
	`257`	`+ break;`
`258`	`258`	`}`
`259`	`259`	`}`
`260`	`260`