Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

Bluetooth: Fix removing connection parameters when unpairing

The commit 89cbb0638e9b7 introduced support for deferred connection
parameter removal when unpairing by removing them only once an
existing connection gets disconnected. However, it failed to address
the scenario when we're *not* connected and do an unpair operation.

What makes things worse is that most user space BlueZ versions will
first issue a disconnect request and only then unpair, meaning the
buggy code will be triggered every time. This effectively causes the
kernel to resume scanning and reconnect to a device for which we've
removed all keys and GATT database information.

This patch fixes the issue by adding the missing call to the
hci_conn_params_del() function to a branch which handles the case of
no existing connection.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org # 3.19+

authored by

Johan Hedberg and committed by
Marcel Holtmann
a6ad2a6b 22f8e9db

+7 -5
+7 -5
net/bluetooth/mgmt.c
··· 3090 3090 } else { 3091 3091 u8 addr_type; 3092 3092 3093 + if (cp->addr.type == BDADDR_LE_PUBLIC) 3094 + addr_type = ADDR_LE_DEV_PUBLIC; 3095 + else 3096 + addr_type = ADDR_LE_DEV_RANDOM; 3097 + 3093 3098 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, 3094 3099 &cp->addr.bdaddr); 3095 3100 if (conn) { ··· 3110 3105 */ 3111 3106 if (!cp->disconnect) 3112 3107 conn = NULL; 3108 + } else { 3109 + hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3113 3110 } 3114 - 3115 - if (cp->addr.type == BDADDR_LE_PUBLIC) 3116 - addr_type = ADDR_LE_DEV_PUBLIC; 3117 - else 3118 - addr_type = ADDR_LE_DEV_RANDOM; 3119 3111 3120 3112 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type); 3121 3113