[Bluetooth] Support create connection cancel command

In case of non-blocking connects it is possible that the last user
of an ACL link quits before the connection has been fully established.
This will lead to a race condition where the internal state of a
connection is closed, but the actual link has been established and is
active. In case of Bluetooth 1.2 and later devices it is possible to
call create connection cancel to abort the connect. For older devices
the disconnect timer will be used to trigger the needed disconnect.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

2 files changed, 12 insertions, 3 deletions

diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 5f04181b8109..10a3eec191fd 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -297,6 +297,7 @@ struct hci_cp_host_buffer_size {
 
 /* Link Control */
 #define OGF_LINK_CTL    0x01 
+
 #define OCF_CREATE_CONN         0x0005
 struct hci_cp_create_conn {
         bdaddr_t bdaddr;
@@ -307,6 +308,11 @@ struct hci_cp_create_conn {
         __u8     role_switch;
 } __attribute__ ((packed));
 
+#define OCF_CREATE_CONN_CANCEL  0x0008
+struct hci_cp_create_conn_cancel {
+        bdaddr_t bdaddr;
+} __attribute__ ((packed));
+
 #define OCF_ACCEPT_CONN_REQ     0x0009
 struct hci_cp_accept_conn_req {
         bdaddr_t bdaddr;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 7451a9c92d9d..df22efcfcc0b 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -316,10 +316,13 @@ static inline void hci_conn_put(struct hci_conn *conn)
         if (atomic_dec_and_test(&conn->refcnt)) {
                 unsigned long timeo;
                 if (conn->type == ACL_LINK) {
-                        timeo = msecs_to_jiffies(HCI_DISCONN_TIMEOUT);
-                        if (!conn->out)
-                                timeo *= 2;
                         del_timer(&conn->idle_timer);
+                        if (conn->state == BT_CONNECTED) {
+                                timeo = msecs_to_jiffies(HCI_DISCONN_TIMEOUT);
+                                if (!conn->out)
+                                        timeo *= 2;
+                        } else
+                                timeo = msecs_to_jiffies(10);
                 } else
                         timeo = msecs_to_jiffies(10);
                 mod_timer(&conn->disc_timer, jiffies + timeo);