Merge tag 'driver-core-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git...

[linux.git] / net / bluetooth / smp.c

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index e68c715f8d371d5b14e272f6b8de1b8f6cf28664..6c2b4e6e87ba8e1cf5c4cb0a8d8c7df9994bb311 100644 (file)
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2579,6 +2579,19 @@ static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
                goto distribute;
        }
 
+       /* Drop IRK if peer is using identity address during pairing but is
+        * providing different address as identity information.
+        *
+        * Microsoft Surface Precision Mouse is known to have this bug.
+        */
+       if (hci_is_identity_address(&hcon->dst, hcon->dst_type) &&
+           (bacmp(&info->bdaddr, &hcon->dst) ||
+            info->addr_type != hcon->dst_type)) {
+               bt_dev_err(hcon->hdev,
+                          "ignoring IRK with invalid identity address");
+               goto distribute;
+       }
+
        bacpy(&smp->id_addr, &info->bdaddr);
        smp->id_addr_type = info->addr_type;