Skip to content

Commit 7f4dbaa

Browse files
linvjwlinvjw
committed
Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
2 parents 740bb82 + 92d1372 commit 7f4dbaa

File tree

6 files changed

+85
-65
lines changed

6 files changed

+85
-65
lines changed

‎net/bluetooth/hci_conn.c

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -610,11 +610,6 @@ static void hci_req_add_le_create_conn(struct hci_request *req,
610610
if (hci_update_random_address(req, false, &own_addr_type))
611611
return;
612612

613-
/* Save the address type used for this connnection attempt so we able
614-
* to retrieve this information if we need it.
615-
*/
616-
conn->src_type = own_addr_type;
617-
618613
cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
619614
cp.scan_window = cpu_to_le16(hdev->le_scan_window);
620615
bacpy(&cp.peer_addr, &conn->dst);
@@ -894,7 +889,7 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
894889
/* If we're already encrypted set the REAUTH_PEND flag,
895890
* otherwise set the ENCRYPT_PEND.
896891
*/
897-
if (conn->key_type != 0xff)
892+
if (conn->link_mode & HCI_LM_ENCRYPT)
898893
set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
899894
else
900895
set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);

‎net/bluetooth/hci_event.c

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,10 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
4848
smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
4949
wake_up_bit(&hdev->flags, HCI_INQUIRY);
5050

51+
hci_dev_lock(hdev);
52+
hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
53+
hci_dev_unlock(hdev);
54+
5155
hci_conn_check_pending(hdev);
5256
}
5357

@@ -3537,7 +3541,11 @@ static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
35373541
cp.authentication = conn->auth_type;
35383542

35393543
/* Request MITM protection if our IO caps allow it
3540-
* except for the no-bonding case
3544+
* except for the no-bonding case.
3545+
* conn->auth_type is not updated here since
3546+
* that might cause the user confirmation to be
3547+
* rejected in case the remote doesn't have the
3548+
* IO capabilities for MITM.
35413549
*/
35423550
if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
35433551
cp.authentication != HCI_AT_NO_BONDING)
@@ -3628,8 +3636,11 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
36283636

36293637
/* If we're not the initiators request authorization to
36303638
* proceed from user space (mgmt_user_confirm with
3631-
* confirm_hint set to 1). */
3632-
if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3639+
* confirm_hint set to 1). The exception is if neither
3640+
* side had MITM in which case we do auto-accept.
3641+
*/
3642+
if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
3643+
(loc_mitm || rem_mitm)) {
36333644
BT_DBG("Confirming auto-accept as acceptor");
36343645
confirm_hint = 1;
36353646
goto confirm;

‎net/bluetooth/l2cap_core.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1663,7 +1663,13 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
16631663
kfree_skb(conn->rx_skb);
16641664

16651665
skb_queue_purge(&conn->pending_rx);
1666-
flush_work(&conn->pending_rx_work);
1666+
1667+
/* We can not call flush_work(&conn->pending_rx_work) here since we
1668+
* might block if we are running on a worker from the same workqueue
1669+
* pending_rx_work is waiting on.
1670+
*/
1671+
if (work_pending(&conn->pending_rx_work))
1672+
cancel_work_sync(&conn->pending_rx_work);
16671673

16681674
l2cap_unregister_all_users(conn);
16691675

‎net/bluetooth/l2cap_sock.c

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -787,11 +787,6 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
787787

788788
/*change security for LE channels */
789789
if (chan->scid == L2CAP_CID_ATT) {
790-
if (!conn->hcon->out) {
791-
err = -EINVAL;
792-
break;
793-
}
794-
795790
if (smp_conn_security(conn->hcon, sec.level))
796791
break;
797792
sk->sk_state = BT_CONFIG;

‎net/bluetooth/mgmt.c

Lines changed: 56 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1047,6 +1047,43 @@ static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
10471047
}
10481048
}
10491049

1050+
static void hci_stop_discovery(struct hci_request *req)
1051+
{
1052+
struct hci_dev *hdev = req->hdev;
1053+
struct hci_cp_remote_name_req_cancel cp;
1054+
struct inquiry_entry *e;
1055+
1056+
switch (hdev->discovery.state) {
1057+
case DISCOVERY_FINDING:
1058+
if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1059+
hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1060+
} else {
1061+
cancel_delayed_work(&hdev->le_scan_disable);
1062+
hci_req_add_le_scan_disable(req);
1063+
}
1064+
1065+
break;
1066+
1067+
case DISCOVERY_RESOLVING:
1068+
e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1069+
NAME_PENDING);
1070+
if (!e)
1071+
return;
1072+
1073+
bacpy(&cp.bdaddr, &e->data.bdaddr);
1074+
hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1075+
&cp);
1076+
1077+
break;
1078+
1079+
default:
1080+
/* Passive scanning */
1081+
if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1082+
hci_req_add_le_scan_disable(req);
1083+
break;
1084+
}
1085+
}
1086+
10501087
static int clean_up_hci_state(struct hci_dev *hdev)
10511088
{
10521089
struct hci_request req;
@@ -1063,9 +1100,7 @@ static int clean_up_hci_state(struct hci_dev *hdev)
10631100
if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
10641101
disable_advertising(&req);
10651102

1066-
if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1067-
hci_req_add_le_scan_disable(&req);
1068-
}
1103+
hci_stop_discovery(&req);
10691104

10701105
list_for_each_entry(conn, &hdev->conn_hash.list, list) {
10711106
struct hci_cp_disconnect dc;
@@ -2996,8 +3031,13 @@ static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
29963031
}
29973032

29983033
if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2999-
/* Continue with pairing via SMP */
3034+
/* Continue with pairing via SMP. The hdev lock must be
3035+
* released as SMP may try to recquire it for crypto
3036+
* purposes.
3037+
*/
3038+
hci_dev_unlock(hdev);
30003039
err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3040+
hci_dev_lock(hdev);
30013041

30023042
if (!err)
30033043
err = cmd_complete(sk, hdev->id, mgmt_op,
@@ -3574,8 +3614,6 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
35743614
{
35753615
struct mgmt_cp_stop_discovery *mgmt_cp = data;
35763616
struct pending_cmd *cmd;
3577-
struct hci_cp_remote_name_req_cancel cp;
3578-
struct inquiry_entry *e;
35793617
struct hci_request req;
35803618
int err;
35813619

@@ -3605,52 +3643,22 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
36053643

36063644
hci_req_init(&req, hdev);
36073645

3608-
switch (hdev->discovery.state) {
3609-
case DISCOVERY_FINDING:
3610-
if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3611-
hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3612-
} else {
3613-
cancel_delayed_work(&hdev->le_scan_disable);
3614-
3615-
hci_req_add_le_scan_disable(&req);
3616-
}
3617-
3618-
break;
3646+
hci_stop_discovery(&req);
36193647

3620-
case DISCOVERY_RESOLVING:
3621-
e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3622-
NAME_PENDING);
3623-
if (!e) {
3624-
mgmt_pending_remove(cmd);
3625-
err = cmd_complete(sk, hdev->id,
3626-
MGMT_OP_STOP_DISCOVERY, 0,
3627-
&mgmt_cp->type,
3628-
sizeof(mgmt_cp->type));
3629-
hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3630-
goto unlock;
3631-
}
3632-
3633-
bacpy(&cp.bdaddr, &e->data.bdaddr);
3634-
hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3635-
&cp);
3636-
3637-
break;
3638-
3639-
default:
3640-
BT_DBG("unknown discovery state %u", hdev->discovery.state);
3641-
3642-
mgmt_pending_remove(cmd);
3643-
err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3644-
MGMT_STATUS_FAILED, &mgmt_cp->type,
3645-
sizeof(mgmt_cp->type));
3648+
err = hci_req_run(&req, stop_discovery_complete);
3649+
if (!err) {
3650+
hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
36463651
goto unlock;
36473652
}
36483653

3649-
err = hci_req_run(&req, stop_discovery_complete);
3650-
if (err < 0)
3651-
mgmt_pending_remove(cmd);
3652-
else
3653-
hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3654+
mgmt_pending_remove(cmd);
3655+
3656+
/* If no HCI commands were sent we're done */
3657+
if (err == -ENODATA) {
3658+
err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3659+
&mgmt_cp->type, sizeof(mgmt_cp->type));
3660+
hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3661+
}
36543662

36553663
unlock:
36563664
hci_dev_unlock(hdev);

‎net/bluetooth/smp.c

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -544,7 +544,7 @@ static u8 smp_random(struct smp_chan *smp)
544544
hci_le_start_enc(hcon, ediv, rand, stk);
545545
hcon->enc_key_size = smp->enc_key_size;
546546
} else {
547-
u8 stk[16];
547+
u8 stk[16], auth;
548548
__le64 rand = 0;
549549
__le16 ediv = 0;
550550

@@ -556,8 +556,13 @@ static u8 smp_random(struct smp_chan *smp)
556556
memset(stk + smp->enc_key_size, 0,
557557
SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
558558

559+
if (hcon->pending_sec_level == BT_SECURITY_HIGH)
560+
auth = 1;
561+
else
562+
auth = 0;
563+
559564
hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
560-
HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
565+
HCI_SMP_STK_SLAVE, auth, stk, smp->enc_key_size,
561566
ediv, rand);
562567
}
563568

0 commit comments

Comments
 (0)