Bluetooth: Fix poll() misbehavior when using BT_DEFER_SETUP

When BT_DEFER_SETUP has been enabled on a Bluetooth socket it keeps
signaling POLLIN all the time. This is a wrong behavior. The POLLIN
should only be signaled if the client socket is in BT_CONNECT2 state
and the parent has been BT_DEFER_SETUP enabled.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

1 files changed, 3 insertions, 4 deletions

diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index ded57974390e..02b9baa1930b 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -270,12 +270,11 @@ static inline unsigned int bt_accept_poll(struct sock *parent)
         struct list_head *p, *n;
         struct sock *sk;
 
-        if (bt_sk(parent)->defer_setup)
-                return POLLIN | POLLRDNORM;
-
         list_for_each_safe(p, n, &bt_sk(parent)->accept_q) {
                 sk = (struct sock *) list_entry(p, struct bt_sock, accept_q);
-                if (sk->sk_state == BT_CONNECTED)
+                if (sk->sk_state == BT_CONNECTED ||
+                                        (bt_sk(parent)->defer_setup &&
+                                                sk->sk_state == BT_CONNECT2))
                         return POLLIN | POLLRDNORM;
         }