Bluetooth: Clear P-192 values for OOB when in Secure Connections Only mode

When Secure Connections Only mode has been enabled and remote OOB data
is requested, then only provide P-256 hash and randomizer vaulues. The
fields for P-192 hash and randomizer should be set to zero.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index e2b81adc232fa3009724e6299012f4c97c651150..0850cad8c36886da559d8a89460344d06afe8844 100644 (file)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4163,33 +4163,39 @@ static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
                goto unlock;
 
        data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
-       if (data) {
-               if (bredr_sc_enabled(hdev)) {
-                       struct hci_cp_remote_oob_ext_data_reply cp;
-
-                       bacpy(&cp.bdaddr, &ev->bdaddr);
-                       memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
-                       memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
-                       memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
-                       memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
+       if (!data) {
+               struct hci_cp_remote_oob_data_neg_reply cp;
 
-                       hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
-                                    sizeof(cp), &cp);
-               } else {
-                       struct hci_cp_remote_oob_data_reply cp;
+               bacpy(&cp.bdaddr, &ev->bdaddr);
+               hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
+                            sizeof(cp), &cp);
+               goto unlock;
+       }
 
-                       bacpy(&cp.bdaddr, &ev->bdaddr);
-                       memcpy(cp.hash, data->hash192, sizeof(cp.hash));
-                       memcpy(cp.rand, data->rand192, sizeof(cp.rand));
+       if (bredr_sc_enabled(hdev)) {
+               struct hci_cp_remote_oob_ext_data_reply cp;
 
-                       hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
-                                    sizeof(cp), &cp);
+               bacpy(&cp.bdaddr, &ev->bdaddr);
+               if (test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
+                       memset(cp.hash192, 0, sizeof(cp.hash192));
+                       memset(cp.rand192, 0, sizeof(cp.rand192));
+               } else {
+                       memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
+                       memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
                }
+               memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
+               memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
+
+               hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
+                            sizeof(cp), &cp);
        } else {
-               struct hci_cp_remote_oob_data_neg_reply cp;
+               struct hci_cp_remote_oob_data_reply cp;
 
                bacpy(&cp.bdaddr, &ev->bdaddr);
-               hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
+               memcpy(cp.hash, data->hash192, sizeof(cp.hash));
+               memcpy(cp.rand, data->rand192, sizeof(cp.rand));
+
+               hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
                             sizeof(cp), &cp);
        }