Merge "Bluetooth: Timeout LE Connection requests" into msm-3.0
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 079538b..733e9d2 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -50,10 +50,13 @@
 	struct hci_dev *hdev = conn->hdev;
 	struct hci_cp_le_create_conn cp;
 
+	BT_DBG("%p", conn);
+
 	conn->state = BT_CONNECT;
 	conn->out = 1;
 	conn->link_mode |= HCI_LM_MASTER;
 	conn->sec_level = BT_SECURITY_LOW;
+	conn->type = LE_LINK;
 
 	memset(&cp, 0, sizeof(cp));
 	cp.scan_interval = cpu_to_le16(0x0004);
@@ -300,9 +303,6 @@
 
 	BT_DBG("conn %p state %d", conn, conn->state);
 
-	if (atomic_read(&conn->refcnt))
-		return;
-
 	hci_dev_lock(hdev);
 
 	switch (conn->state) {
@@ -317,11 +317,14 @@
 		break;
 	case BT_CONFIG:
 	case BT_CONNECTED:
-		reason = hci_proto_disconn_ind(conn);
-		hci_acl_disconn(conn, reason);
+		if (!atomic_read(&conn->refcnt)) {
+			reason = hci_proto_disconn_ind(conn);
+			hci_acl_disconn(conn, reason);
+		}
 		break;
 	default:
-		conn->state = BT_CLOSED;
+		if (!atomic_read(&conn->refcnt))
+			conn->state = BT_CLOSED;
 		break;
 	}
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index e2d6490..da8b780 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1352,6 +1352,10 @@
 			else
 				BT_ERR("No memory for new connection");
 		}
+
+		if (conn)
+			mod_timer(&conn->disc_timer,
+					jiffies + msecs_to_jiffies(5000));
 	}
 
 	hci_dev_unlock(hdev);
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 848a515..a328db9 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1411,6 +1411,10 @@
 		BT_DBG("Unable to find a pending command");
 		return;
 	}
+
+	if (status)
+		pairing_complete(cmd, status);
+
 	hci_conn_put(conn);
 }