Bluetooth: Fixes l2cap "command reject" reply according to spec

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / l2cap_core.c

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index ab2e244a76c4f7ef2b1973955c176ed3bb36c758..52c791ed038dd943f624e84e78315570fd29497d 100644 (file)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2277,9 +2277,9 @@ done:
 
 static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
 {
-       struct l2cap_cmd_rej *rej = (struct l2cap_cmd_rej *) data;
+       struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
 
-       if (rej->reason != 0x0000)
+       if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
                return 0;
 
        if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
@@ -2524,9 +2524,12 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
        sk = chan->sk;
 
        if (chan->state != BT_CONFIG) {
-               struct l2cap_cmd_rej rej;
+               struct l2cap_cmd_rej_cid rej;
+
+               rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
+               rej.scid = cpu_to_le16(chan->scid);
+               rej.dcid = cpu_to_le16(chan->dcid);
 
-               rej.reason = cpu_to_le16(0x0002);
                l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
                                sizeof(rej), &rej);
                goto unlock;
@@ -3017,12 +3020,12 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
                        err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
 
                if (err) {
-                       struct l2cap_cmd_rej rej;
+                       struct l2cap_cmd_rej_unk rej;
 
                        BT_ERR("Wrong link type (%d)", err);
 
                        /* FIXME: Map err to a valid reason */
-                       rej.reason = cpu_to_le16(0);
+                       rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
                        l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
                }