From: Luiz Augusto von Dentz <[email protected]>
hci_cmd_sync_cancel_sync shall check the error passed to it since it
will be propagated using req_result which is __u32 it needs to be
properly set to a positive value if it was passed as negative othertise
IS_ERR will not trigger as -(errno) would be converted to a positive
value.
Fixes: 711c35949648 ("Bluetooth: hci_core: Cancel request on command timeout")
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
---
net/bluetooth/hci_core.c | 6 +++---
net/bluetooth/hci_sync.c | 5 ++++-
2 files changed, 7 insertions(+), 4 deletions(-)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 1690ae57a09d..a7028d38c1f5 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2874,7 +2874,7 @@ static void hci_cancel_cmd_sync(struct hci_dev *hdev, int err)
cancel_delayed_work_sync(&hdev->ncmd_timer);
atomic_set(&hdev->cmd_cnt, 1);
- hci_cmd_sync_cancel_sync(hdev, -err);
+ hci_cmd_sync_cancel_sync(hdev, err);
}
/* Suspend HCI device */
@@ -2894,7 +2894,7 @@ int hci_suspend_dev(struct hci_dev *hdev)
return 0;
/* Cancel potentially blocking sync operation before suspend */
- hci_cancel_cmd_sync(hdev, -EHOSTDOWN);
+ hci_cancel_cmd_sync(hdev, EHOSTDOWN);
hci_req_sync_lock(hdev);
ret = hci_suspend_sync(hdev);
@@ -4210,7 +4210,7 @@ static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)
err = hci_send_frame(hdev, skb);
if (err < 0) {
- hci_cmd_sync_cancel_sync(hdev, err);
+ hci_cmd_sync_cancel_sync(hdev, -err);
return;
}
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 639090b9f4b8..8fe02921adf1 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -617,7 +617,10 @@ void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err)
bt_dev_dbg(hdev, "err 0x%2.2x", err);
if (hdev->req_status == HCI_REQ_PEND) {
- hdev->req_result = err;
+ /* req_result is __u32 so error must be positive to be properly
+ * propagated.
+ */
+ hdev->req_result = err < 0 ? -err : err;
hdev->req_status = HCI_REQ_CANCELED;
wake_up_interruptible(&hdev->req_wait_q);
--
2.44.0
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=838479
---Test result---
Test Summary:
CheckPatch PASS 1.28 seconds
GitLint PASS 0.28 seconds
SubjectPrefix PASS 0.10 seconds
BuildKernel PASS 29.04 seconds
CheckAllWarning PASS 32.00 seconds
CheckSparse PASS 37.18 seconds
CheckSmatch PASS 100.34 seconds
BuildKernel32 PASS 27.52 seconds
TestRunnerSetup PASS 519.04 seconds
TestRunner_l2cap-tester PASS 18.16 seconds
TestRunner_iso-tester PASS 30.99 seconds
TestRunner_bnep-tester PASS 4.87 seconds
TestRunner_mgmt-tester PASS 114.43 seconds
TestRunner_rfcomm-tester PASS 7.42 seconds
TestRunner_sco-tester PASS 13.00 seconds
TestRunner_ioctl-tester PASS 7.83 seconds
TestRunner_mesh-tester PASS 5.94 seconds
TestRunner_smp-tester PASS 6.92 seconds
TestRunner_userchan-tester PASS 4.98 seconds
IncrementalBuild PASS 26.02 seconds
---
Regards,
Linux Bluetooth
On 26.03.24 17:43, Luiz Augusto von Dentz wrote:
> From: Luiz Augusto von Dentz <[email protected]>
>
> hci_cmd_sync_cancel_sync shall check the error passed to it since it
> will be propagated using req_result which is __u32 it needs to be
> properly set to a positive value if it was passed as negative othertise
> IS_ERR will not trigger as -(errno) would be converted to a positive
> value.
>
> Fixes: 711c35949648 ("Bluetooth: hci_core: Cancel request on command timeout")
> Signed-off-by: Luiz Augusto von Dentz <[email protected]>
This fixed my problem:
Reported-and-tested-by: Thorsten Leemhuis <[email protected]>
Closes:
https://lore.kernel.org/all/[email protected]/
Ciao, Thorsten
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[email protected]>:
On Tue, 26 Mar 2024 12:43:17 -0400 you wrote:
> From: Luiz Augusto von Dentz <[email protected]>
>
> hci_cmd_sync_cancel_sync shall check the error passed to it since it
> will be propagated using req_result which is __u32 it needs to be
> properly set to a positive value if it was passed as negative othertise
> IS_ERR will not trigger as -(errno) would be converted to a positive
> value.
>
> [...]
Here is the summary with links:
- [v1] Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync
https://git.kernel.org/bluetooth/bluetooth-next/c/e9c62fdc7f3e
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html