2 files changed, 9 insertions, 10 deletions

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 08016683e8aa..2c097322b126 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3471,6 +3471,11 @@ static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 /* If we are initiators, there is no remote information yet */
                 if (conn->remote_auth == 0xff) {
                         cp.authentication = conn->auth_type;
+
+                        /* Use MITM protection for outgoing dedicated bonding */
+                        if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
+                            cp.authentication == HCI_AT_DEDICATED_BONDING)
+                                cp.authentication |= 0x01;
                 } else {
                         conn->auth_type = hci_get_auth_req(conn);
                         cp.authentication = conn->auth_type;
@@ -3542,12 +3547,9 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
         rem_mitm = (conn->remote_auth & 0x01);
 
         /* If we require MITM but the remote device can't provide that
-         * (it has NoInputNoOutput) then reject the confirmation
-         * request. The only exception is when we're dedicated bonding
-         * initiators (connect_cfm_cb set) since then we always have the MITM
-         * bit set. */
-        if (!conn->connect_cfm_cb && loc_mitm &&
-            conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
+         * (it has NoInputNoOutput) then reject the confirmation request
+         */
+        if (loc_mitm && conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
                 BT_DBG("Rejecting request: remote device can't provide MITM");
                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
                              sizeof(ev->bdaddr), &ev->bdaddr);
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 11cb00a2befb..54abbce3a39e 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2850,10 +2850,7 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         }
 
         sec_level = BT_SECURITY_MEDIUM;
-        if (cp->io_cap == 0x03)
-                auth_type = HCI_AT_DEDICATED_BONDING;
-        else
-                auth_type = HCI_AT_DEDICATED_BONDING_MITM;
+        auth_type = HCI_AT_DEDICATED_BONDING;
 
         if (cp->addr.type == BDADDR_BREDR) {
                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,