Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next

4 files changed, 70 insertions, 79 deletions

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 6ccc4eb9e55e..03e83558a411 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1275,15 +1275,17 @@ static void hci_init3_req(struct hci_request *req, unsigned long opt)
                 hci_setup_link_policy(req);
 
         if (lmp_le_capable(hdev)) {
-                /* If the controller has a public BD_ADDR, then by
-                 * default use that one. If this is a LE only
-                 * controller without one, default to the random
-                 * address.
-                 */
-                if (bacmp(&hdev->bdaddr, BDADDR_ANY))
-                        hdev->own_addr_type = ADDR_LE_DEV_PUBLIC;
-                else
-                        hdev->own_addr_type = ADDR_LE_DEV_RANDOM;
+                if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
+                        /* If the controller has a public BD_ADDR, then
+                         * by default use that one. If this is a LE only
+                         * controller without a public address, default
+                         * to the random address.
+                         */
+                        if (bacmp(&hdev->bdaddr, BDADDR_ANY))
+                                hdev->own_addr_type = ADDR_LE_DEV_PUBLIC;
+                        else
+                                hdev->own_addr_type = ADDR_LE_DEV_RANDOM;
+                }
 
                 hci_set_le_support(req);
         }
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 5935f748c0f9..5fb3df66c2cd 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -486,7 +486,10 @@ static void hci_cc_read_local_commands(struct hci_dev *hdev,
 
         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 
-        if (!rp->status)
+        if (rp->status)
+                return;
+
+        if (test_bit(HCI_SETUP, &hdev->dev_flags))
                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 }
 
@@ -538,12 +541,6 @@ static void hci_cc_read_local_features(struct hci_dev *hdev,
 
         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
-
-        BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
-               hdev->features[0][0], hdev->features[0][1],
-               hdev->features[0][2], hdev->features[0][3],
-               hdev->features[0][4], hdev->features[0][5],
-               hdev->features[0][6], hdev->features[0][7]);
 }
 
 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
@@ -1782,7 +1779,9 @@ static u8 hci_to_mgmt_reason(u8 err)
 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_disconn_complete *ev = (void *) skb->data;
+        u8 reason = hci_to_mgmt_reason(ev->reason);
         struct hci_conn *conn;
+        u8 type;
 
         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
 
@@ -1792,43 +1791,38 @@ static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
         if (!conn)
                 goto unlock;
 
-        if (ev->status == 0)
-                conn->state = BT_CLOSED;
+        if (ev->status) {
+                mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
+                                       conn->dst_type, ev->status);
+                goto unlock;
+        }
 
-        if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags) &&
-            (conn->type == ACL_LINK || conn->type == LE_LINK)) {
-                if (ev->status) {
-                        mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
-                                               conn->dst_type, ev->status);
-                } else {
-                        u8 reason = hci_to_mgmt_reason(ev->reason);
+        conn->state = BT_CLOSED;
 
-                        mgmt_device_disconnected(hdev, &conn->dst, conn->type,
-                                                 conn->dst_type, reason);
-                }
-        }
+        if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
+                mgmt_device_disconnected(hdev, &conn->dst, conn->type,
+                                         conn->dst_type, reason);
 
-        if (ev->status == 0) {
-                u8 type = conn->type;
+        if (conn->type == ACL_LINK && conn->flush_key)
+                hci_remove_link_key(hdev, &conn->dst);
 
-                if (type == ACL_LINK && conn->flush_key)
-                        hci_remove_link_key(hdev, &conn->dst);
-                hci_proto_disconn_cfm(conn, ev->reason);
-                hci_conn_del(conn);
+        type = conn->type;
 
-                /* Re-enable advertising if necessary, since it might
-                 * have been disabled by the connection. From the
-                 * HCI_LE_Set_Advertise_Enable command description in
-                 * the core specification (v4.0):
-                 * "The Controller shall continue advertising until the Host
-                 * issues an LE_Set_Advertise_Enable command with
-                 * Advertising_Enable set to 0x00 (Advertising is disabled)
-                 * or until a connection is created or until the Advertising
-                 * is timed out due to Directed Advertising."
-                 */
-                if (type == LE_LINK)
-                        mgmt_reenable_advertising(hdev);
-        }
+        hci_proto_disconn_cfm(conn, ev->reason);
+        hci_conn_del(conn);
+
+        /* Re-enable advertising if necessary, since it might
+         * have been disabled by the connection. From the
+         * HCI_LE_Set_Advertise_Enable command description in
+         * the core specification (v4.0):
+         * "The Controller shall continue advertising until the Host
+         * issues an LE_Set_Advertise_Enable command with
+         * Advertising_Enable set to 0x00 (Advertising is disabled)
+         * or until a connection is created or until the Advertising
+         * is timed out due to Directed Advertising."
+         */
+        if (type == LE_LINK)
+                mgmt_reenable_advertising(hdev);
 
 unlock:
         hci_dev_unlock(hdev);
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 074d83690a41..a03ca3ca91bf 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1264,7 +1264,7 @@ static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 
                 if (cp->val == 0x02) {
                         /* Limited discoverable mode */
-                        hci_cp.num_iac = 2;
+                        hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
                         hci_cp.iac_lap[1] = 0x8b;
                         hci_cp.iac_lap[2] = 0x9e;
@@ -4595,6 +4595,9 @@ void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
         struct mgmt_ev_device_disconnected ev;
         struct sock *sk = NULL;
 
+        if (link_type != ACL_LINK && link_type != LE_LINK)
+                return;
+
         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
 
         bacpy(&ev.addr.bdaddr, bdaddr);
@@ -4613,6 +4616,8 @@ void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
                             u8 link_type, u8 addr_type, u8 status)
 {
+        u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
+        struct mgmt_cp_disconnect *cp;
         struct mgmt_rp_disconnect rp;
         struct pending_cmd *cmd;
 
@@ -4623,8 +4628,16 @@ void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
         if (!cmd)
                 return;
 
+        cp = cmd->param;
+
+        if (bacmp(bdaddr, &cp->addr.bdaddr))
+                return;
+
+        if (cp->addr.type != bdaddr_type)
+                return;
+
         bacpy(&rp.addr.bdaddr, bdaddr);
-        rp.addr.type = link_to_bdaddr(link_type, addr_type);
+        rp.addr.type = bdaddr_type;
 
         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
                      mgmt_status(status), &rp, sizeof(rp));
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 4b07acb8293c..e61e74a1aabb 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -53,8 +53,7 @@ static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
 {
         struct blkcipher_desc desc;
         struct scatterlist sg;
-        int err, iv_len;
-        unsigned char iv[128];
+        int err;
 
         if (tfm == NULL) {
                 BT_ERR("tfm %p", tfm);
@@ -72,12 +71,6 @@ static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
 
         sg_init_one(&sg, r, 16);
 
-        iv_len = crypto_blkcipher_ivsize(tfm);
-        if (iv_len) {
-                memset(&iv, 0xff, iv_len);
-                crypto_blkcipher_set_iv(tfm, iv, iv_len);
-        }
-
         err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
         if (err)
                 BT_ERR("Encrypt data error %d", err);
@@ -143,13 +136,6 @@ static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
         return err;
 }
 
-static int smp_rand(u8 *buf)
-{
-        get_random_bytes(buf, 16);
-
-        return 0;
-}
-
 static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
                                      u16 dlen, void *data)
 {
@@ -257,11 +243,11 @@ static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
         return 0;
 }
 
-static void smp_failure(struct l2cap_conn *conn, u8 reason, u8 send)
+static void smp_failure(struct l2cap_conn *conn, u8 reason)
 {
         struct hci_conn *hcon = conn->hcon;
 
-        if (send)
+        if (reason)
                 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
                              &reason);
 
@@ -406,7 +392,7 @@ static void confirm_work(struct work_struct *work)
         return;
 
 error:
-        smp_failure(conn, reason, 1);
+        smp_failure(conn, reason);
 }
 
 static void random_work(struct work_struct *work)
@@ -490,7 +476,7 @@ static void random_work(struct work_struct *work)
         return;
 
 error:
-        smp_failure(conn, reason, 1);
+        smp_failure(conn, reason);
 }
 
 static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
@@ -555,10 +541,10 @@ int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
                 break;
         case MGMT_OP_USER_PASSKEY_NEG_REPLY:
         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
-                smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED, 1);
+                smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
                 return 0;
         default:
-                smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED, 1);
+                smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
                 return -EOPNOTSUPP;
         }
 
@@ -606,9 +592,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
         if (check_enc_key_size(conn, key_size))
                 return SMP_ENC_KEY_SIZE;
 
-        ret = smp_rand(smp->prnd);
-        if (ret)
-                return SMP_UNSPECIFIED;
+        get_random_bytes(smp->prnd, sizeof(smp->prnd));
 
         smp->prsp[0] = SMP_CMD_PAIRING_RSP;
         memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
@@ -644,9 +628,7 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
         if (check_enc_key_size(conn, key_size))
                 return SMP_ENC_KEY_SIZE;
 
-        ret = smp_rand(smp->prnd);
-        if (ret)
-                return SMP_UNSPECIFIED;
+        get_random_bytes(smp->prnd, sizeof(smp->prnd));
 
         smp->prsp[0] = SMP_CMD_PAIRING_RSP;
         memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
@@ -895,7 +877,7 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
                 break;
 
         case SMP_CMD_PAIRING_FAIL:
-                smp_failure(conn, skb->data[0], 0);
+                smp_failure(conn, 0);
                 reason = 0;
                 err = -EPERM;
                 break;
@@ -941,7 +923,7 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
 
 done:
         if (reason)
-                smp_failure(conn, reason, 1);
+                smp_failure(conn, reason);
 
         kfree_skb(skb);
         return err;