[Bluetooth] Fix reference counting during ACL config stage

The ACL config stage keeps holding a reference count on incoming
connections when requesting the extended features. This results in
keeping an ACL link up without any users. The problem here is that
the Bluetooth specification doesn't define an ownership of the ACL
link and thus it can happen that the implementation on the initiator
side doesn't care about disconnecting unused links. In this case the
acceptor needs to take care of this.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 0e3db289f4be2b1f97fca8034f26150b56013b26..ad7a553d77131c469bf4c9ebc3bc8bbfe84d1a33 100644 (file)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1605,14 +1605,11 @@ static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_b
 
                if (conn->state == BT_CONFIG) {
                        if (!ev->status && hdev->ssp_mode > 0 &&
-                                                       conn->ssp_mode > 0) {
-                               if (conn->out) {
-                                       struct hci_cp_auth_requested cp;
-                                       cp.handle = ev->handle;
-                                       hci_send_cmd(hdev,
-                                               HCI_OP_AUTH_REQUESTED,
+                                       conn->ssp_mode > 0 && conn->out) {
+                               struct hci_cp_auth_requested cp;
+                               cp.handle = ev->handle;
+                               hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
                                                        sizeof(cp), &cp);
-                               }
                        } else {
                                conn->state = BT_CONNECTED;
                                hci_proto_connect_cfm(conn, ev->status);