Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To:     linux-bluetooth@vger.kernel.org
Subject: [PATCH BlueZ] btdev: Fix not checking if a CIG has any active CIS
Date:   Thu,  7 Jul 2022 17:27:51 -0700
Message-Id: <20220708002751.2308369-1-luiz.dentz@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Bluetooth Core specification says the CIG must be in configurable state
in order to accept the SetCIGParameters:

BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2553:

 'If the Host issues this command when the CIG is not in the
  configurable state, the Controller shall return the error
  code Command Disallowed (0x0C).'
---
 emulator/btdev.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/emulator/btdev.c b/emulator/btdev.c
index 641e308b3..3fdfb64a9 100644
--- a/emulator/btdev.c
+++ b/emulator/btdev.c
@@ -5831,8 +5831,25 @@ static int cmd_set_cig_params(struct btdev *dev, const void *data,
 	rsp.params.cig_id = cmd->cig_id;
 
 	for (i = 0; i < cmd->num_cis; i++) {
+		struct btdev_conn *iso;
+
 		rsp.params.num_handles++;
 		rsp.handle[i] = cpu_to_le16(ISO_HANDLE + i);
+
+		/* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E
+		 * page 2553
+		 *
+		 * If the Host issues this command when the CIG is not in the
+		 * configurable state, the Controller shall return the error
+		 * code Command Disallowed (0x0C).
+		 */
+		iso = queue_find(dev->conns, match_handle,
+				UINT_TO_PTR(cpu_to_le16(rsp.handle[i])));
+		if (iso) {
+			rsp.params.status = BT_HCI_ERR_INVALID_PARAMETERS;
+			i = 0;
+			goto done;
+		}
 	}
 
 done:
-- 
2.35.3