Bluetooth: Add support for SMP timeout

This patch adds support for disconnecting the link when SMP procedure
takes more than 30 seconds.

SMP begins when either the Pairing Request command is sent or the
Pairing Response is received, and it ends when the link is encrypted
(or terminated). Vol 3, Part H Section 3.4.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

1 files changed, 14 insertions, 0 deletions

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index dfd6891b9c86..39886786eb7f 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -27,6 +27,8 @@
 #include <linux/crypto.h>
 #include <crypto/b128ops.h>
 
+#define SMP_TIMEOUT 30000 /* 30 seconds */
+
 static inline void swap128(u8 src[16], u8 dst[16])
 {
         int i;
@@ -228,6 +230,9 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
         smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(*rp), rp);
 
+        mod_timer(&conn->security_timer, jiffies +
+                                        msecs_to_jiffies(SMP_TIMEOUT));
+
         return 0;
 }
 
@@ -303,6 +308,9 @@ static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
                 smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
         }
 
+        mod_timer(&conn->security_timer, jiffies +
+                                        msecs_to_jiffies(SMP_TIMEOUT));
+
         return 0;
 }
 
@@ -382,6 +390,9 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
         smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
 
+        mod_timer(&conn->security_timer, jiffies +
+                                        msecs_to_jiffies(SMP_TIMEOUT));
+
         set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend);
 
         return 0;
@@ -415,6 +426,9 @@ int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
                 conn->preq[0] = SMP_CMD_PAIRING_REQ;
                 memcpy(&conn->preq[1], &cp, sizeof(cp));
 
+                mod_timer(&conn->security_timer, jiffies +
+                                        msecs_to_jiffies(SMP_TIMEOUT));
+
                 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
         } else {
                 struct smp_cmd_security_req cp;