1 files changed, 22 insertions, 1 deletions

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a37f809591ad..15784d32108d 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5218,9 +5218,10 @@ static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
                                 u8 *data)
 {
         struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
+        struct hci_conn *hcon = conn->hcon;
         u16 dcid, mtu, mps, credits, result;
         struct l2cap_chan *chan;
-        int err;
+        int err, sec_level;
 
         if (cmd_len < sizeof(*rsp))
                 return -EPROTO;
@@ -5259,6 +5260,26 @@ static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
                 l2cap_chan_ready(chan);
                 break;
 
+        case L2CAP_CR_AUTHENTICATION:
+        case L2CAP_CR_ENCRYPTION:
+                /* If we already have MITM protection we can't do
+                 * anything.
+                 */
+                if (hcon->sec_level > BT_SECURITY_MEDIUM) {
+                        l2cap_chan_del(chan, ECONNREFUSED);
+                        break;
+                }
+
+                sec_level = hcon->sec_level + 1;
+                if (chan->sec_level < sec_level)
+                        chan->sec_level = sec_level;
+
+                /* We'll need to send a new Connect Request */
+                clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
+
+                smp_conn_security(hcon, chan->sec_level);
+                break;
+
         default:
                 l2cap_chan_del(chan, ECONNREFUSED);
                 break;