Bluetooth: Call l2cap_conn_shutdown() when SMP recv callback fails (4befb867) · Commits · 戴 / test

To restore pre-l2cap_chan functionality we should be trying to disconnect the connection when receviving garbage SMP data (i.e. when the SMP command handler fails). This patch renames the command handler back to smp_sig_channel() and adds a smp_recv_cb() wrapper function for calling it. If smp_sig_channel() fails the code calls l2cap_conn_shutdown(). Signed-off-by:

Johan Hedberg <johan.hedberg@intel.com> Signed-off-by:

Marcel Holtmann <marcel@holtmann.org>

net/bluetooth/smp.c

+19 −1

Original line number	Diff line number	Diff line
		@@ -1375,7 +1375,7 @@ static int smp_cmd_sign_info(struct l2cap_conn conn, struct sk_buff skb)
		return 0;
		}

		static int smp_recv_cb(struct l2cap_chan chan, struct sk_buff skb)
		static int smp_sig_channel(struct l2cap_chan chan, struct sk_buff skb)
		{
		struct l2cap_conn *conn = chan->conn;
		struct hci_conn *hcon = conn->hcon;
		@@ -1514,6 +1514,24 @@ static void smp_ready_cb(struct l2cap_chan *chan)
		l2cap_chan_hold(chan);
		}

		static int smp_recv_cb(struct l2cap_chan chan, struct sk_buff skb)
		{
		int err;

		BT_DBG("chan %p", chan);

		err = smp_sig_channel(chan, skb);
		if (err) {
		struct l2cap_conn *conn = chan->conn;

		cancel_delayed_work_sync(&conn->security_timer);

		l2cap_conn_shutdown(chan->conn, -err);
		}

		return err;
		}

		static struct sk_buff smp_alloc_skb_cb(struct l2cap_chan chan,
		unsigned long hdr_len,
		unsigned long len, int nb)

Admin message