Bluetooth: Fix SMP error and response to be mutually exclusive (9b7b18ef) · Commits · 戴 / test

Returning failure from the SMP data parsing function will cause an immediate disconnect, making any attempts to send a response PDU futile. This patch updates the function to always either send a response or return an error, but never both at the same time: * In the case that HCI_LE_ENABLED is not set we want to send a Pairing Not Supported response but it is not required to force a disconnection, so do not set the error return in this case. * If we get garbage SMP data we can just fail with the handler function instead of also trying to send an SMP Failure PDU. * There's no reason to force a disconnection if we receive an unknown SMP command. Instead simply send a proper Command Not Supported SMP response. Signed-off-by:

Johan Hedberg <johan.hedberg@intel.com> Signed-off-by:

Marcel Holtmann <marcel@holtmann.org>

net/bluetooth/smp.c

+5 −8

Original line number	Diff line number	Diff line
		@@ -1430,7 +1430,6 @@ static int smp_sig_channel(struct l2cap_chan chan, struct sk_buff skb)
		return -EILSEQ;

		if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
		err = -EOPNOTSUPP;
		reason = SMP_PAIRING_NOTSUPP;
		goto done;
		}
		@@ -1447,7 +1446,6 @@ static int smp_sig_channel(struct l2cap_chan chan, struct sk_buff skb)
		if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
		!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
		BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
		reason = SMP_CMD_NOTSUPP;
		err = -EOPNOTSUPP;
		goto done;
		}
		@@ -1459,7 +1457,6 @@ static int smp_sig_channel(struct l2cap_chan chan, struct sk_buff skb)

		case SMP_CMD_PAIRING_FAIL:
		smp_failure(conn, 0);
		reason = 0;
		err = -EPERM;
		break;

		@@ -1501,17 +1498,17 @@ static int smp_sig_channel(struct l2cap_chan chan, struct sk_buff skb)

		default:
		BT_DBG("Unknown command code 0x%2.2x", code);

		reason = SMP_CMD_NOTSUPP;
		err = -EOPNOTSUPP;
		goto done;
		}

		done:
		if (!err) {
		if (reason)
		smp_failure(conn, reason);
		if (!err)
		kfree_skb(skb);
		}

		return err;
		}

Admin message