[ 3.5.yuz extended stable ] Patch "Bluetooth: SMP: Fix setting unknown auth_req bits" has been added to staging queue

Herton Ronaldo Krzesinski herton.krzesinski at canonical.com
Thu Nov 22 04:45:31 UTC 2012

This is a note to let you know that I have just added a patch titled

    Bluetooth: SMP: Fix setting unknown auth_req bits

to the linux-3.5.y-queue branch of the 3.5.yuz extended stable tree 
which can be found at:


If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.yuz tree, see



>From 4de841d88269c38b8c9c3fbb321e574003499ef1 Mon Sep 17 00:00:00 2001
From: Johan Hedberg <johan.hedberg at intel.com>
Date: Thu, 11 Oct 2012 16:26:06 +0200
Subject: [PATCH] Bluetooth: SMP: Fix setting unknown auth_req bits

commit 065a13e2cc665f6547dc7e8a9d6b6565badf940a upstream.

When sending a pairing request or response we should not just blindly
copy the value that the remote device sent. Instead we should at least
make sure to mask out any unknown bits. This is particularly critical
from the upcoming LE Secure Connections feature perspective as
incorrectly indicating support for it (by copying the remote value)
would cause a failure to pair with devices that support it.

Signed-off-by: Johan Hedberg <johan.hedberg at intel.com>
Acked-by: Marcel Holtmann <marcel at holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan at collabora.co.uk>
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski at canonical.com>
 net/bluetooth/smp.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 926043c..22fe004 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -31,6 +31,8 @@

 #define SMP_TIMEOUT	msecs_to_jiffies(30000)

+#define AUTH_REQ_MASK   0x07
 static inline void swap128(u8 src[16], u8 dst[16])
 	int i;
@@ -229,7 +231,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
 		req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
 		req->init_key_dist = 0;
 		req->resp_key_dist = dist_keys;
-		req->auth_req = authreq;
+		req->auth_req = (authreq & AUTH_REQ_MASK);

@@ -238,7 +240,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
 	rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
 	rsp->init_key_dist = 0;
 	rsp->resp_key_dist = req->resp_key_dist & dist_keys;
-	rsp->auth_req = authreq;
+	rsp->auth_req = (authreq & AUTH_REQ_MASK);

 static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)

More information about the kernel-team mailing list