Bluetooth: Fix LE Pairing time-out
Timer that was started at beginning of LE Pairing did not correctly
terminate pairing process when it fired, and was not properly cleaned
up on pairing completion.
Signed-off-by: Brian Gix <bgix@codeaurora.org>
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index bbb637d..17a6f12 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1724,6 +1724,9 @@
if (conn->type == ACL_LINK || conn->type == LE_LINK)
mgmt_disconnected(hdev->id, &conn->dst);
+ if (conn->type == LE_LINK)
+ del_timer(&conn->smp_timer);
+
hci_proto_disconn_cfm(conn, ev->reason);
hci_conn_del(conn);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 2149ebe..76b0185 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1058,13 +1058,6 @@
l2cap_conn_start(conn);
}
-static void security_timeout(unsigned long arg)
-{
- struct l2cap_conn *conn = (void *) arg;
-
- l2cap_conn_del(conn->hcon, ETIMEDOUT);
-}
-
static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
{
struct l2cap_conn *conn = hcon->l2cap_data;
@@ -1095,7 +1088,7 @@
rwlock_init(&conn->chan_list.lock);
if (hcon->type == LE_LINK)
- setup_timer(&conn->security_timer, security_timeout,
+ setup_timer(&hcon->smp_timer, smp_timeout,
(unsigned long) conn);
else
setup_timer(&conn->info_timer, l2cap_info_timeout,
@@ -7263,7 +7256,7 @@
if (!status && encrypt)
l2cap_pi(sk)->sec_level = hcon->sec_level;
- del_timer(&conn->security_timer);
+ del_timer(&hcon->smp_timer);
l2cap_chan_ready(sk);
smp_link_encrypt_cmplt(conn, status, encrypt);
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 8943510..aea2447 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -437,6 +437,7 @@
BT_DBG("smp_send_cmd: SMP_CMD_PAIRING_FAIL");
smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
&reason);
+ del_timer(&hcon->smp_timer);
hci_conn_put(hcon);
} else if (hcon->cfm_pending) {
BT_DBG("send_pairing_confirm");
@@ -490,8 +491,7 @@
smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
- mod_timer(&conn->security_timer, jiffies +
- msecs_to_jiffies(SMP_TIMEOUT));
+ mod_timer(&hcon->smp_timer, jiffies + msecs_to_jiffies(SMP_TIMEOUT));
return 0;
}
@@ -569,8 +569,7 @@
hcon->cfm_pending = TRUE;
- mod_timer(&conn->security_timer, jiffies +
- msecs_to_jiffies(SMP_TIMEOUT));
+ mod_timer(&hcon->smp_timer, jiffies + msecs_to_jiffies(SMP_TIMEOUT));
return 0;
}
@@ -682,8 +681,7 @@
smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
- mod_timer(&conn->security_timer, jiffies +
- msecs_to_jiffies(SMP_TIMEOUT));
+ mod_timer(&hcon->smp_timer, jiffies + msecs_to_jiffies(SMP_TIMEOUT));
set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend);
@@ -750,7 +748,7 @@
hcon->preq[0] = SMP_CMD_PAIRING_REQ;
memcpy(&hcon->preq[1], &cp, sizeof(cp));
- mod_timer(&conn->security_timer, jiffies +
+ mod_timer(&hcon->smp_timer, jiffies +
msecs_to_jiffies(SMP_TIMEOUT));
smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
@@ -846,6 +844,7 @@
case SMP_CMD_PAIRING_FAIL:
reason = 0;
err = -EPERM;
+ del_timer(&hcon->smp_timer);
hci_conn_put(hcon);
break;
@@ -893,6 +892,7 @@
BT_ERR("SMP_CMD_PAIRING_FAIL: %d", reason);
smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
&reason);
+ del_timer(&hcon->smp_timer);
hci_conn_put(hcon);
}
@@ -984,6 +984,8 @@
if (hcon->out || rsp->resp_key_dist) {
if (hcon->disconn_cfm_cb)
hcon->disconn_cfm_cb(hcon, 0);
+
+ del_timer(&hcon->smp_timer);
hci_conn_put(hcon);
}
@@ -1005,3 +1007,14 @@
return 0;
}
+
+void smp_timeout(unsigned long arg)
+{
+ struct l2cap_conn *conn = (void *) arg;
+ u8 reason = SMP_UNSPECIFIED;
+
+ BT_DBG("%p", conn);
+
+ smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason), &reason);
+ hci_conn_put(conn->hcon);
+}