iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bluetooth: Call l2cap_conn_shutdown() when SMP recv callback fails

Browse Source 
To restore pre-l2cap_chan functionality we should be trying to
disconnect the connection when receviving garbage SMP data (i.e. when
the SMP command handler fails). This patch renames the command handler
back to smp_sig_channel() and adds a smp_recv_cb() wrapper function for
calling it. If smp_sig_channel() fails the code calls
l2cap_conn_shutdown().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
This commit is contained in:
Johan Hedberg 2014-08-11 22:06:38 +03:00 committed by Marcel Holtmann
parent dec5b49235
commit 4befb867b9
1 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
net/bluetooth/smp.c
View File

@ -1375,7 +1375,7 @@ static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
return 0;
}
static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)
{
struct l2cap_conn *conn = chan->conn;
struct hci_conn *hcon = conn->hcon;
@ -1514,6 +1514,24 @@ static void smp_ready_cb(struct l2cap_chan *chan)
l2cap_chan_hold(chan);
}
static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
{
int err;
BT_DBG("chan %p", chan);
err = smp_sig_channel(chan, skb);
if (err) {
struct l2cap_conn *conn = chan->conn;
cancel_delayed_work_sync(&conn->security_timer);
l2cap_conn_shutdown(chan->conn, -err);
}
return err;
}
static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
unsigned long hdr_len,
unsigned long len, int nb)