Bluetooth: Fix missing address type check for removing LTKs

When removing Long Term Keys we should also be checking that the given
address type (public vs random) matches. This patch updates the
hci_remove_ltk function to take an extra parameter and uses it for
address type matching.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

1 files changed, 11 insertions, 3 deletions

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 782e2bb10881..473f8687b28b 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2318,10 +2318,18 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                 goto unlock;
         }
 
-        if (cp->addr.type == BDADDR_BREDR)
+        if (cp->addr.type == BDADDR_BREDR) {
                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
-        else
-                err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
+        } else {
+                u8 addr_type;
+
+                if (cp->addr.type == BDADDR_LE_PUBLIC)
+                        addr_type = ADDR_LE_DEV_PUBLIC;
+                else
+                        addr_type = ADDR_LE_DEV_RANDOM;
+
+                err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
+        }
 
         if (err < 0) {
                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,