Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

2 files changed, 16 insertions, 3 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 25bfce0666eb..4925a02ae7e4 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -249,12 +249,12 @@ static void hci_conn_disconnect(struct hci_conn *conn)
         __u8 reason = hci_proto_disconn_ind(conn);
 
         switch (conn->type) {
-        case ACL_LINK:
-                hci_acl_disconn(conn, reason);
-                break;
         case AMP_LINK:
                 hci_amp_disconn(conn, reason);
                 break;
+        default:
+                hci_acl_disconn(conn, reason);
+                break;
         }
 }
 
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 68a9587c9694..5abefb12891d 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -859,6 +859,19 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
 
         skb_pull(skb, sizeof(code));
 
+        /*
+         * The SMP context must be initialized for all other PDUs except
+         * pairing and security requests. If we get any other PDU when
+         * not initialized simply disconnect (done if this function
+         * returns an error).
+         */
+        if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
+            !conn->smp_chan) {
+                BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
+                kfree_skb(skb);
+                return -ENOTSUPP;
+        }
+
         switch (code) {
         case SMP_CMD_PAIRING_REQ:
                 reason = smp_cmd_pairing_req(conn, skb);