Commit 6946b9c9 authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz
Browse files

Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync 



hci_cmd_sync_cancel_sync shall check the error passed to it since it
will be propagated using req_result which is __u32 it needs to be
properly set to a positive value if it was passed as negative othertise
IS_ERR will not trigger as -(errno) would be converted to a positive
value.

Fixes: 63298d6e ("Bluetooth: hci_core: Cancel request on command timeout")
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Reported-and-tested-by: default avatarThorsten Leemhuis <linux@leemhuis.info>
Closes: https://lore.kernel.org/all/08275279-7462-4f4a-a0ee-8aa015f829bc@leemhuis.info/
parent 77f45cca

net/bluetooth/hci_core.c

+3 −3
Original line number Diff line number Diff line
@@ -2874,7 +2874,7 @@ static void hci_cancel_cmd_sync(struct hci_dev *hdev, int err) 
	cancel_delayed_work_sync(&hdev->ncmd_timer);

	atomic_set(&hdev->cmd_cnt, 1);



	hci_cmd_sync_cancel_sync(hdev, -err);

	hci_cmd_sync_cancel_sync(hdev, err);

}



/* Suspend HCI device */
@@ -2894,7 +2894,7 @@ int hci_suspend_dev(struct hci_dev *hdev) 
		return 0;



	/* Cancel potentially blocking sync operation before suspend */

	hci_cancel_cmd_sync(hdev, -EHOSTDOWN);

	hci_cancel_cmd_sync(hdev, EHOSTDOWN);



	hci_req_sync_lock(hdev);

	ret = hci_suspend_sync(hdev);
@@ -4210,7 +4210,7 @@ static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb) 


	err = hci_send_frame(hdev, skb);

	if (err < 0) {

		hci_cmd_sync_cancel_sync(hdev, err);

		hci_cmd_sync_cancel_sync(hdev, -err);

		return;

	}

net/bluetooth/hci_sync.c

+4 −1
Original line number Diff line number Diff line
@@ -617,7 +617,10 @@ void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err) 
	bt_dev_dbg(hdev, "err 0x%2.2x", err);



	if (hdev->req_status == HCI_REQ_PEND) {

		hdev->req_result = err;

		/* req_result is __u32 so error must be positive to be properly

		 * propagated.

		 */

		hdev->req_result = err < 0 ? -err : err;

		hdev->req_status = HCI_REQ_CANCELED;



		wake_up_interruptible(&hdev->req_wait_q);