Bluetooth: Fix clearing SMP keys if pairing fails
authorJohan Hedberg <johan.hedberg@intel.com>
Fri, 28 Feb 2014 08:10:16 +0000 (10:10 +0200)
committerJohan Hedberg <johan.hedberg@intel.com>
Fri, 28 Feb 2014 10:36:10 +0000 (12:36 +0200)
If SMP fails we should not leave any keys (LTKs or IRKs) hanging around
the internal lists. This patch adds the necessary code to
smp_chan_destroy to remove any keys we may have in case of pairing
failure.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
net/bluetooth/smp.c

index 99abffcaf16b84ef459f5f9ef67f8da9d9b36a1b..f1cb6a32e93f1ea6f6d5276dab055fa33f49f86f 100644 (file)
@@ -589,6 +589,24 @@ void smp_chan_destroy(struct l2cap_conn *conn)
        complete = test_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
        mgmt_smp_complete(conn->hcon, complete);
 
+       /* If pairing failed clean up any keys we might have */
+       if (!complete) {
+               if (smp->ltk) {
+                       list_del(&smp->ltk->list);
+                       kfree(smp->ltk);
+               }
+
+               if (smp->slave_ltk) {
+                       list_del(&smp->slave_ltk->list);
+                       kfree(smp->slave_ltk);
+               }
+
+               if (smp->remote_irk) {
+                       list_del(&smp->remote_irk->list);
+                       kfree(smp->remote_irk);
+               }
+       }
+
        kfree(smp);
        conn->smp_chan = NULL;
        conn->hcon->smp_conn = NULL;