[Bluetooth] Fix reference counting during ACL config stage

The ACL config stage keeps holding a reference count on incoming
connections when requesting the extended features. This results in
keeping an ACL link up without any users. The problem here is that
the Bluetooth specification doesn't define an ownership of the ACL
link and thus it can happen that the implementation on the initiator
side doesn't care about disconnecting unused links. In this case the
acceptor needs to take care of this.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

1 files changed, 4 insertions, 7 deletions

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 0e3db289f4be..ad7a553d7713 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1605,14 +1605,11 @@ static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_b
 
                 if (conn->state == BT_CONFIG) {
                         if (!ev->status && hdev->ssp_mode > 0 &&
-                                                        conn->ssp_mode > 0) {
-                                if (conn->out) {
-                                        struct hci_cp_auth_requested cp;
-                                        cp.handle = ev->handle;
-                                        hci_send_cmd(hdev,
-                                                HCI_OP_AUTH_REQUESTED,
+                                        conn->ssp_mode > 0 && conn->out) {
+                                struct hci_cp_auth_requested cp;
+                                cp.handle = ev->handle;
+                                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
                                                         sizeof(cp), &cp);
-                                }
                         } else {
                                 conn->state = BT_CONNECTED;
                                 hci_proto_connect_cfm(conn, ev->status);