1 files changed, 6 insertions, 3 deletions

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index c4ac2849d9c2..37df4e9b3896 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -703,7 +703,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
         return 0;
 }
 
-static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
+static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
 {
         struct smp_ltk *key;
         struct hci_conn *hcon = conn->hcon;
@@ -712,6 +712,9 @@ static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
         if (!key)
                 return 0;
 
+        if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
+                return 0;
+
         if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
                 return 1;
 
@@ -732,7 +735,7 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
         hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
 
-        if (smp_ltk_encrypt(conn))
+        if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
                 return 0;
 
         if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
@@ -771,7 +774,7 @@ int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
                 return 1;
 
         if (hcon->link_mode & HCI_LM_MASTER)
-                if (smp_ltk_encrypt(conn))
+                if (smp_ltk_encrypt(conn, sec_level))
                         goto done;
 
         if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))