1 files changed, 62 insertions, 12 deletions

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 55534244c3a0..184ba0a88ec0 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -866,8 +866,16 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
-        if (!conn)
-                goto unlock;
+        if (!conn) {
+                if (ev->link_type != SCO_LINK)
+                        goto unlock;
+
+                conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
+                if (!conn)
+                        goto unlock;
+
+                conn->type = SCO_LINK;
+        }
 
         if (!ev->status) {
                 conn->handle = __le16_to_cpu(ev->handle);
@@ -875,6 +883,7 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                 if (conn->type == ACL_LINK) {
                         conn->state = BT_CONFIG;
                         hci_conn_hold(conn);
+                        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
                 } else
                         conn->state = BT_CONNECTED;
 
@@ -1055,9 +1064,14 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                                 hci_proto_connect_cfm(conn, ev->status);
                                 hci_conn_put(conn);
                         }
-                } else
+                } else {
                         hci_auth_cfm(conn, ev->status);
 
+                        hci_conn_hold(conn);
+                        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                        hci_conn_put(conn);
+                }
+
                 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
                         if (!ev->status) {
                                 struct hci_cp_set_conn_encrypt cp;
@@ -1471,7 +1485,21 @@ static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb
 
 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
+        struct hci_ev_pin_code_req *ev = (void *) skb->data;
+        struct hci_conn *conn;
+
         BT_DBG("%s", hdev->name);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (conn && conn->state == BT_CONNECTED) {
+                hci_conn_hold(conn);
+                conn->disc_timeout = HCI_PAIRING_TIMEOUT;
+                hci_conn_put(conn);
+        }
+
+        hci_dev_unlock(hdev);
 }
 
 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1481,7 +1509,21 @@ static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff
 
 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
+        struct hci_ev_link_key_notify *ev = (void *) skb->data;
+        struct hci_conn *conn;
+
         BT_DBG("%s", hdev->name);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (conn) {
+                hci_conn_hold(conn);
+                conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                hci_conn_put(conn);
+        }
+
+        hci_dev_unlock(hdev);
 }
 
 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1646,20 +1688,28 @@ static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_bu
                 conn->type = SCO_LINK;
         }
 
-        if (conn->out && ev->status == 0x1c && conn->attempt < 2) {
-                conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
-                                        (hdev->esco_type & EDR_ESCO_MASK);
-                hci_setup_sync(conn, conn->link->handle);
-                goto unlock;
-        }
-
-        if (!ev->status) {
+        switch (ev->status) {
+        case 0x00:
                 conn->handle = __le16_to_cpu(ev->handle);
                 conn->state  = BT_CONNECTED;
 
                 hci_conn_add_sysfs(conn);
-        } else
+                break;
+
+        case 0x1c:      /* SCO interval rejected */
+        case 0x1f:      /* Unspecified error */
+                if (conn->out && conn->attempt < 2) {
+                        conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
+                                        (hdev->esco_type & EDR_ESCO_MASK);
+                        hci_setup_sync(conn, conn->link->handle);
+                        goto unlock;
+                }
+                /* fall through */
+
+        default:
                 conn->state = BT_CLOSED;
+                break;
+        }
 
         hci_proto_connect_cfm(conn, ev->status);
         if (ev->status)