From:   Brian Gix <brian.gix@gmail.com>
To:     linux-bluetooth@vger.kernel.org
Cc:     brian.gix@intel.com, brian.gix@gmail.com, inga.stotland@intel.com
Subject: [PATCH BlueZ v2 3/3] mesh: Don't send Prov Failed on non-existant links
Date:   Wed, 15 Mar 2023 18:16:27 -0700
Message-Id: <20230316011627.27322-3-brian.gix@gmail.com>
In-Reply-To: <20230316011627.27322-1-brian.gix@gmail.com>
References: <20230316011627.27322-1-brian.gix@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

If remote device does not respond to a Prov Link Open request, then the
callbacks do not get established, and attempting to send Failure
messages on the non-existent link rersult in seg fault.
---
 mesh/remprv-server.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/mesh/remprv-server.c b/mesh/remprv-server.c
index 6a9efdd47..927dbab0e 100644
--- a/mesh/remprv-server.c
+++ b/mesh/remprv-server.c
@@ -546,7 +546,7 @@ static bool remprv_srv_pkt(uint16_t src, uint16_t unicast, uint16_t app_idx,
 	bool segmented = false;
 	uint32_t opcode;
 	uint8_t msg[69];
-	uint8_t status;
+	uint8_t old_state, status;
 	uint16_t n;
 
 	if (app_idx != APP_IDX_DEV_LOCAL)
@@ -843,10 +843,12 @@ static bool remprv_srv_pkt(uint16_t src, uint16_t unicast, uint16_t app_idx,
 		if (!prov || prov->node != node || prov->client != src)
 			return true;
 
+		old_state = prov->state;
 		prov->state = PB_REMOTE_STATE_LINK_CLOSING;
 		mesh_io_send_cancel(NULL, &pkt_filter, sizeof(pkt_filter));
 		send_prov_status(prov, PB_REM_ERR_SUCCESS);
-		if (pkt[0] == 0x02) {
+		if (pkt[0] == 0x02 &&
+				old_state >= PB_REMOTE_STATE_LINK_ACTIVE) {
 			msg[0] = PROV_FAILED;
 			msg[1] = PROV_ERR_CANT_ASSIGN_ADDR;
 			if (prov->nppi_proc == RPR_ADV)
-- 
2.39.2