Make sure that the auto_complete() function will not be called with the
NULL connection, because it is required by that function.
** NOTE FOR REVIEWERS **
The change in the cmd_link_key_reply_complete() function was done based
on the code from other *_complete() functions. In most of them, in case
of NULL connection the conn_complete() was used instead. But I'm not
100% sure that it's the right approach (not even 90% sure...).
---
emulator/btdev.c | 15 ++++++---------
1 file changed, 6 insertions(+), 9 deletions(-)
diff --git a/emulator/btdev.c b/emulator/btdev.c
index c76b89db9..2564d96f2 100644
--- a/emulator/btdev.c
+++ b/emulator/btdev.c
@@ -1453,7 +1453,7 @@ static void auth_complete(struct btdev_conn *conn, uint8_t status)
memset(&ev, 0, sizeof(ev));
- ev.handle = conn ? cpu_to_le16(conn->handle) : 0x0000;
+ ev.handle = cpu_to_le16(conn->handle);
ev.status = status;
send_event(conn->dev, BT_HCI_EVT_AUTH_COMPLETE, &ev, sizeof(ev));
@@ -1491,10 +1491,10 @@ static int cmd_link_key_reply_complete(struct btdev *dev, const void *data,
status = BT_HCI_ERR_AUTH_FAILURE;
done:
- auth_complete(conn, status);
-
if (conn)
auth_complete(conn->link, status);
+ else
+ conn_complete(dev, cmd->bdaddr, status);
return 0;
}
@@ -1681,28 +1681,25 @@ static int cmd_pin_code_neg_reply_complete(struct btdev *dev, const void *data,
uint8_t len)
{
const struct bt_hci_cmd_pin_code_request_neg_reply *cmd = data;
+ const uint8_t status = BT_HCI_ERR_PIN_OR_KEY_MISSING;
struct btdev *remote;
struct btdev_conn *conn;
- uint8_t status;
remote = find_btdev_by_bdaddr(cmd->bdaddr);
if (!remote)
return 0;
- status = BT_HCI_ERR_PIN_OR_KEY_MISSING;
-
conn = queue_find(dev->conns, match_bdaddr, cmd->bdaddr);
if (conn)
auth_complete(conn, status);
else
- conn_complete(dev, cmd->bdaddr, BT_HCI_ERR_PIN_OR_KEY_MISSING);
+ conn_complete(dev, cmd->bdaddr, status);
if (conn) {
if (remote->pin_len)
auth_complete(conn->link, status);
} else {
- conn_complete(remote, dev->bdaddr,
- BT_HCI_ERR_PIN_OR_KEY_MISSING);
+ conn_complete(remote, dev->bdaddr, status);
}
return 0;
--
2.39.2
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=793242
---Test result---
Test Summary:
CheckPatch PASS 0.52 seconds
GitLint PASS 0.35 seconds
BuildEll PASS 29.36 seconds
BluezMake PASS 900.58 seconds
MakeCheck PASS 12.56 seconds
MakeDistcheck PASS 178.02 seconds
CheckValgrind PASS 277.59 seconds
CheckSmatch WARNING 368.83 seconds
bluezmakeextell PASS 119.38 seconds
IncrementalBuild PASS 753.77 seconds
ScanBuild WARNING 1122.62 seconds
Details
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
emulator/btdev.c:420:29: warning: Variable length array is used.
##############################
Test: ScanBuild - WARNING
Desc: Run Scan Build
Output:
emulator/btdev.c:1083:10: warning: Although the value stored to 'conn' is used in the enclosing expression, the value is never actually read from 'conn'
while ((conn = queue_find(dev->conns, match_handle,
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
emulator/btdev.c:1334:24: warning: Access to field 'link' results in a dereference of a null pointer (loaded from variable 'conn')
pending_conn_del(dev, conn->link->dev);
^~~~~~~~~~
2 warnings generated.
---
Regards,
Linux Bluetooth