Bluetooth: Fix checking for pending Set SSP in Set HS handler

Changing the HS setting requires that SSP is enabled, however so far the
code only checked for the SSP flag but not a potentially ongoing Set SSP
operation. This patch adds a check for a pending Set SSP command in the
Set HS handler, and returns a 'busy' error if one is found.
Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

net/bluetooth/mgmt.c

@@ -2175,6 +2175,12 @@ static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
 	hci_dev_lock(hdev);
 
+	if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
+		err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+				 MGMT_STATUS_BUSY);
+		goto unlock;
+	}
+
 	if (cp->val) {
 		changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
 	} else {