4 files changed, 112 insertions, 63 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 1181db08d9de..fa47d5d84f5c 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -171,10 +171,8 @@ static void hci_conn_timeout(unsigned long arg)
         switch (conn->state) {
         case BT_CONNECT:
         case BT_CONNECT2:
-                if (conn->type == ACL_LINK)
+                if (conn->type == ACL_LINK && conn->out)
                         hci_acl_connect_cancel(conn);
-                else
-                        hci_acl_disconn(conn, 0x13);
                 break;
         case BT_CONFIG:
         case BT_CONNECTED:
@@ -215,6 +213,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         conn->state = BT_OPEN;
 
         conn->power_save = 1;
+        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 
         switch (type) {
         case ACL_LINK:
@@ -247,6 +246,8 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         if (hdev->notify)
                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 
+        hci_conn_init_sysfs(conn);
+
         tasklet_enable(&hdev->tx_task);
 
         return conn;
@@ -289,6 +290,8 @@ int hci_conn_del(struct hci_conn *conn)
 
         hci_conn_del_sysfs(conn);
 
+        hci_dev_put(hdev);
+
         return 0;
 }
 
@@ -424,12 +427,9 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
         if (sec_level == BT_SECURITY_SDP)
                 return 1;
 
-        if (sec_level == BT_SECURITY_LOW) {
-                if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0)
-                        return hci_conn_auth(conn, sec_level, auth_type);
-                else
-                        return 1;
-        }
+        if (sec_level == BT_SECURITY_LOW &&
+                                (!conn->ssp_mode || !conn->hdev->ssp_mode))
+                return 1;
 
         if (conn->link_mode & HCI_LM_ENCRYPT)
                 return hci_conn_auth(conn, sec_level, auth_type);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 55534244c3a0..184ba0a88ec0 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -866,8 +866,16 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
-        if (!conn)
-                goto unlock;
+        if (!conn) {
+                if (ev->link_type != SCO_LINK)
+                        goto unlock;
+
+                conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
+                if (!conn)
+                        goto unlock;
+
+                conn->type = SCO_LINK;
+        }
 
         if (!ev->status) {
                 conn->handle = __le16_to_cpu(ev->handle);
@@ -875,6 +883,7 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                 if (conn->type == ACL_LINK) {
                         conn->state = BT_CONFIG;
                         hci_conn_hold(conn);
+                        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
                 } else
                         conn->state = BT_CONNECTED;
 
@@ -1055,9 +1064,14 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                                 hci_proto_connect_cfm(conn, ev->status);
                                 hci_conn_put(conn);
                         }
-                } else
+                } else {
                         hci_auth_cfm(conn, ev->status);
 
+                        hci_conn_hold(conn);
+                        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                        hci_conn_put(conn);
+                }
+
                 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
                         if (!ev->status) {
                                 struct hci_cp_set_conn_encrypt cp;
@@ -1471,7 +1485,21 @@ static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb
 
 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
+        struct hci_ev_pin_code_req *ev = (void *) skb->data;
+        struct hci_conn *conn;
+
         BT_DBG("%s", hdev->name);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (conn && conn->state == BT_CONNECTED) {
+                hci_conn_hold(conn);
+                conn->disc_timeout = HCI_PAIRING_TIMEOUT;
+                hci_conn_put(conn);
+        }
+
+        hci_dev_unlock(hdev);
 }
 
 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1481,7 +1509,21 @@ static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff
 
 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
+        struct hci_ev_link_key_notify *ev = (void *) skb->data;
+        struct hci_conn *conn;
+
         BT_DBG("%s", hdev->name);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (conn) {
+                hci_conn_hold(conn);
+                conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                hci_conn_put(conn);
+        }
+
+        hci_dev_unlock(hdev);
 }
 
 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1646,20 +1688,28 @@ static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_bu
                 conn->type = SCO_LINK;
         }
 
-        if (conn->out && ev->status == 0x1c && conn->attempt < 2) {
-                conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
-                                        (hdev->esco_type & EDR_ESCO_MASK);
-                hci_setup_sync(conn, conn->link->handle);
-                goto unlock;
-        }
-
-        if (!ev->status) {
+        switch (ev->status) {
+        case 0x00:
                 conn->handle = __le16_to_cpu(ev->handle);
                 conn->state  = BT_CONNECTED;
 
                 hci_conn_add_sysfs(conn);
-        } else
+                break;
+
+        case 0x1c:      /* SCO interval rejected */
+        case 0x1f:      /* Unspecified error */
+                if (conn->out && conn->attempt < 2) {
+                        conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
+                                        (hdev->esco_type & EDR_ESCO_MASK);
+                        hci_setup_sync(conn, conn->link->handle);
+                        goto unlock;
+                }
+                /* fall through */
+
+        default:
                 conn->state = BT_CLOSED;
+                break;
+        }
 
         hci_proto_connect_cfm(conn, ev->status);
         if (ev->status)
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index ed82796d4a0f..95f7a7a544b4 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -9,8 +9,7 @@
 struct class *bt_class = NULL;
 EXPORT_SYMBOL_GPL(bt_class);
 
-static struct workqueue_struct *btaddconn;
-static struct workqueue_struct *btdelconn;
+static struct workqueue_struct *bt_workq;
 
 static inline char *link_typetostr(int type)
 {
@@ -88,35 +87,17 @@ static struct device_type bt_link = {
 
 static void add_conn(struct work_struct *work)
 {
-        struct hci_conn *conn = container_of(work, struct hci_conn, work);
+        struct hci_conn *conn = container_of(work, struct hci_conn, work_add);
+        struct hci_dev *hdev = conn->hdev;
 
-        flush_workqueue(btdelconn);
+        dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
 
         if (device_add(&conn->dev) < 0) {
                 BT_ERR("Failed to register connection device");
                 return;
         }
-}
-
-void hci_conn_add_sysfs(struct hci_conn *conn)
-{
-        struct hci_dev *hdev = conn->hdev;
-
-        BT_DBG("conn %p", conn);
-
-        conn->dev.type = &bt_link;
-        conn->dev.class = bt_class;
-        conn->dev.parent = &hdev->dev;
 
-        dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
-
-        dev_set_drvdata(&conn->dev, conn);
-
-        device_initialize(&conn->dev);
-
-        INIT_WORK(&conn->work, add_conn);
-
-        queue_work(btaddconn, &conn->work);
+        hci_dev_hold(hdev);
 }
 
 /*
@@ -131,9 +112,12 @@ static int __match_tty(struct device *dev, void *data)
 
 static void del_conn(struct work_struct *work)
 {
-        struct hci_conn *conn = container_of(work, struct hci_conn, work);
+        struct hci_conn *conn = container_of(work, struct hci_conn, work_del);
         struct hci_dev *hdev = conn->hdev;
 
+        if (!device_is_registered(&conn->dev))
+                return;
+
         while (1) {
                 struct device *dev;
 
@@ -146,19 +130,40 @@ static void del_conn(struct work_struct *work)
 
         device_del(&conn->dev);
         put_device(&conn->dev);
+
         hci_dev_put(hdev);
 }
 
-void hci_conn_del_sysfs(struct hci_conn *conn)
+void hci_conn_init_sysfs(struct hci_conn *conn)
 {
+        struct hci_dev *hdev = conn->hdev;
+
         BT_DBG("conn %p", conn);
 
-        if (!device_is_registered(&conn->dev))
-                return;
+        conn->dev.type = &bt_link;
+        conn->dev.class = bt_class;
+        conn->dev.parent = &hdev->dev;
 
-        INIT_WORK(&conn->work, del_conn);
+        dev_set_drvdata(&conn->dev, conn);
+
+        device_initialize(&conn->dev);
 
-        queue_work(btdelconn, &conn->work);
+        INIT_WORK(&conn->work_add, add_conn);
+        INIT_WORK(&conn->work_del, del_conn);
+}
+
+void hci_conn_add_sysfs(struct hci_conn *conn)
+{
+        BT_DBG("conn %p", conn);
+
+        queue_work(bt_workq, &conn->work_add);
+}
+
+void hci_conn_del_sysfs(struct hci_conn *conn)
+{
+        BT_DBG("conn %p", conn);
+
+        queue_work(bt_workq, &conn->work_del);
 }
 
 static inline char *host_typetostr(int type)
@@ -435,20 +440,13 @@ void hci_unregister_sysfs(struct hci_dev *hdev)
 
 int __init bt_sysfs_init(void)
 {
-        btaddconn = create_singlethread_workqueue("btaddconn");
-        if (!btaddconn)
+        bt_workq = create_singlethread_workqueue("bluetooth");
+        if (!bt_workq)
                 return -ENOMEM;
 
-        btdelconn = create_singlethread_workqueue("btdelconn");
-        if (!btdelconn) {
-                destroy_workqueue(btaddconn);
-                return -ENOMEM;
-        }
-
         bt_class = class_create(THIS_MODULE, "bluetooth");
         if (IS_ERR(bt_class)) {
-                destroy_workqueue(btdelconn);
-                destroy_workqueue(btaddconn);
+                destroy_workqueue(bt_workq);
                 return PTR_ERR(bt_class);
         }
 
@@ -457,8 +455,7 @@ int __init bt_sysfs_init(void)
 
 void bt_sysfs_cleanup(void)
 {
-        destroy_workqueue(btaddconn);
-        destroy_workqueue(btdelconn);
+        destroy_workqueue(bt_workq);
 
         class_destroy(bt_class);
 }
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 1d0fb0f23c63..374536e050aa 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1194,6 +1194,8 @@ void rfcomm_dlc_accept(struct rfcomm_dlc *d)
 
         rfcomm_send_ua(d->session, d->dlci);
 
+        rfcomm_dlc_clear_timer(d);
+
         rfcomm_dlc_lock(d);
         d->state = BT_CONNECTED;
         d->state_change(d, 0);