2021-10-28 11:20:36

by Archie Pusaka

Subject: [PATCH] Bluetooth: Fix removing adv when processing cmd complete

From: Archie Pusaka <[email protected]>

If we remove one instance of adv using Set Extended Adv Enable, there
is a possibility of issue occurs when processing the Command Complete
event. Especially, the adv_info might not be found since we already
remove it in hci_req_clear_adv_instance() -> hci_remove_adv_instance().
If that's the case, we will mistakenly proceed to remove all adv
instances instead of just one single instance.

This patch fixes the issue by checking the content of the HCI command
instead of checking whether the adv_info is found.

Signed-off-by: Archie Pusaka <[email protected]>
Reviewed-by: Sonny Sasaka <[email protected]>

---

net/bluetooth/hci_event.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 3cba2bbefcd6..894670419a27 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1326,8 +1326,10 @@ static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
&conn->le_conn_timeout,
conn->conn_timeout);
} else {
- if (adv) {
- adv->enabled = false;
+ if (cp->num_of_sets) {
+ if (adv)
+ adv->enabled = false;
+
/* If just one instance was disabled check if there are
* any other instance enabled before clearing HCI_LE_ADV
*/
--
2.33.0.1079.g6e70778dc9-goog

2021-10-28 22:14:44

by Luiz Augusto von Dentz

Subject: Re: [PATCH] Bluetooth: Fix removing adv when processing cmd complete

Hi Archie,

On Thu, Oct 28, 2021 at 4:17 AM Archie Pusaka <[email protected]> wrote:
>
> From: Archie Pusaka <[email protected]>
>
> If we remove one instance of adv using Set Extended Adv Enable, there
> is a possibility of issue occurs when processing the Command Complete
> event. Especially, the adv_info might not be found since we already
> remove it in hci_req_clear_adv_instance() -> hci_remove_adv_instance().
> If that's the case, we will mistakenly proceed to remove all adv
> instances instead of just one single instance.
>
> This patch fixes the issue by checking the content of the HCI command
> instead of checking whether the adv_info is found.
>
> Signed-off-by: Archie Pusaka <[email protected]>
> Reviewed-by: Sonny Sasaka <[email protected]>
>
> ---
>
> net/bluetooth/hci_event.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
> index 3cba2bbefcd6..894670419a27 100644
> --- a/net/bluetooth/hci_event.c
> +++ b/net/bluetooth/hci_event.c
> @@ -1326,8 +1326,10 @@ static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
> &conn->le_conn_timeout,
> conn->conn_timeout);
> } else {
> - if (adv) {
> - adv->enabled = false;
> + if (cp->num_of_sets) {
> + if (adv)
> + adv->enabled = false;
> +
> /* If just one instance was disabled check if there are
> * any other instance enabled before clearing HCI_LE_ADV
> */
> --
> 2.33.0.1079.g6e70778dc9-goog

Applied, thanks.

--
Luiz Augusto von Dentz

2021-10-29 08:33:51

by Marcel Holtmann

Subject: Re: [PATCH] Bluetooth: Fix removing adv when processing cmd complete

Hi Luiz,

>> If we remove one instance of adv using Set Extended Adv Enable, there
>> is a possibility of issue occurs when processing the Command Complete
>> event. Especially, the adv_info might not be found since we already
>> remove it in hci_req_clear_adv_instance() -> hci_remove_adv_instance().
>> If that's the case, we will mistakenly proceed to remove all adv
>> instances instead of just one single instance.
>>
>> This patch fixes the issue by checking the content of the HCI command
>> instead of checking whether the adv_info is found.
>>
>> Signed-off-by: Archie Pusaka <[email protected]>
>> Reviewed-by: Sonny Sasaka <[email protected]>
>>
>> ---
>>
>> net/bluetooth/hci_event.c | 6 ++++--
>> 1 file changed, 4 insertions(+), 2 deletions(-)
>>
>> diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
>> index 3cba2bbefcd6..894670419a27 100644
>> --- a/net/bluetooth/hci_event.c
>> +++ b/net/bluetooth/hci_event.c
>> @@ -1326,8 +1326,10 @@ static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
>> &conn->le_conn_timeout,
>> conn->conn_timeout);
>> } else {
>> - if (adv) {
>> - adv->enabled = false;
>> + if (cp->num_of_sets) {
>> + if (adv)
>> + adv->enabled = false;
>> +
>> /* If just one instance was disabled check if there are
>> * any other instance enabled before clearing HCI_LE_ADV
>> */

I haven’t applied this yet since I wanted to make sure it doesn’t interfere with our set of 23 patches. Do you need to rebase?

Regards

Marcel