Merge tag 'v3.10.55' into update

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_event.c

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
old mode 100644 (file)
new mode 100755 (executable)
index b93cd2e..1526fb2
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1119,7 +1119,7 @@ static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
                }
        } else {
                if (!conn) {
-                       conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
+                       conn = hci_conn_add(hdev, ACL_LINK, 0, &cp->bdaddr);
                        if (conn) {
                                conn->out = true;
                                conn->link_mode |= HCI_LM_MASTER;
@@ -1748,6 +1748,15 @@ unlock:
        hci_conn_check_pending(hdev);
 }
 
+static inline bool is_sco_active(struct hci_dev *hdev)
+{
+       if (hci_conn_hash_lookup_state(hdev, SCO_LINK, BT_CONNECTED) ||
+                       (hci_conn_hash_lookup_state(hdev, ESCO_LINK,
+                                                   BT_CONNECTED)))
+               return true;
+       return false;
+}
+
 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
        struct hci_ev_conn_request *ev = (void *) skb->data;
@@ -1775,7 +1784,8 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
                                               &ev->bdaddr);
                if (!conn) {
-                       conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
+                       /* pkt_type not yet used for incoming connections */
+                       conn = hci_conn_add(hdev, ev->link_type, 0, &ev->bdaddr);
                        if (!conn) {
                                BT_ERR("No memory for new connection");
                                hci_dev_unlock(hdev);
@@ -1794,7 +1804,8 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
                        bacpy(&cp.bdaddr, &ev->bdaddr);
 
-                       if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
+                       if (lmp_rswitch_capable(hdev) && ((mask & HCI_LM_MASTER)
+                                               || is_sco_active(hdev)))
                                cp.role = 0x00; /* Become master */
                        else
                                cp.role = 0x01; /* Remain slave */
@@ -2963,6 +2974,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
                hci_conn_add_sysfs(conn);
                break;
 
+       case 0x10:      /* Connection Accept Timeout */
        case 0x11:      /* Unsupported Feature or Parameter Value */
        case 0x1c:      /* SCO interval rejected */
        case 0x1a:      /* Unsupported Remote Feature */
@@ -3051,6 +3063,12 @@ static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
        if (!conn)
                goto unlock;
 
+       /* For BR/EDR the necessary steps are taken through the
+        * auth_complete event.
+        */
+       if (conn->type != LE_LINK)
+               goto unlock;
+
        if (!ev->status)
                conn->sec_level = conn->pending_sec_level;
 
@@ -3212,8 +3230,11 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
 
                /* If we're not the initiators request authorization to
                 * proceed from user space (mgmt_user_confirm with
-                * confirm_hint set to 1). */
-               if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
+                * confirm_hint set to 1). The exception is if neither
+                * side had MITM in which case we do auto-accept.
+                */
+               if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
+                   (loc_mitm || rem_mitm)) {
                        BT_DBG("Confirming auto-accept as acceptor");
                        confirm_hint = 1;
                        goto confirm;
@@ -3531,7 +3552,7 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
        conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
        if (!conn) {
-               conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
+               conn = hci_conn_add(hdev, LE_LINK, 0, &ev->bdaddr);
                if (!conn) {
                        BT_ERR("No memory for new connection");
                        goto unlock;
@@ -3611,11 +3632,21 @@ static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
        cp.handle = cpu_to_le16(conn->handle);
 
        if (ltk->authenticated)
-               conn->sec_level = BT_SECURITY_HIGH;
+               conn->pending_sec_level = BT_SECURITY_HIGH;
+       else
+               conn->pending_sec_level = BT_SECURITY_MEDIUM;
+
+       conn->enc_key_size = ltk->enc_size;
 
        hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
 
-       if (ltk->type & HCI_SMP_STK) {
+       /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
+        * temporary key used to encrypt a connection following
+        * pairing. It is used during the Encrypted Session Setup to
+        * distribute the keys. Later, security can be re-established
+        * using a distributed LTK.
+        */
+       if (ltk->type == HCI_SMP_STK_SLAVE) {
                list_del(&ltk->list);
                kfree(ltk);
        }