Bluetooth: Fix checking for pending Set SSP in Set HS handler

Changing the HS setting requires that SSP is enabled, however so far the
code only checked for the SSP flag but not a potentially ongoing Set SSP
operation. This patch adds a check for a pending Set SSP command in the
Set HS handler, and returns a 'busy' error if one is found.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

1 files changed, 6 insertions, 0 deletions

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index cc67d19a7cb8..3a1b537c9aa6 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2175,6 +2175,12 @@ static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
         hci_dev_lock(hdev);
 
+        if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+                                 MGMT_STATUS_BUSY);
+                goto unlock;
+        }
+
         if (cp->val) {
                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
         } else {