Commit fdd9ebcc authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'for-net-2025-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth 

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

 - MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
 - MGMT: Protect mgmt_pending list with its own lock
 - hci_core: fix list_for_each_entry_rcu usage
 - btintel_pcie: Increase the tx and rx descriptor count
 - btintel_pcie: Reduce driver buffer posting to prevent race condition
 - btintel_pcie: Fix driver not posting maximum rx buffers

* tag 'for-net-2025-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: MGMT: Protect mgmt_pending list with its own lock
  Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
  Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition
  Bluetooth: btintel_pcie: Increase the tx and rx descriptor count
  Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers
  Bluetooth: hci_core: fix list_for_each_entry_rcu usage
====================

Link: https://patch.msgid.link/20250605191136.904411-1-luiz.dentz@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 82ffbe77 6fe26f69

drivers/bluetooth/btintel_pcie.c

+18 −13
Original line number Diff line number Diff line
@@ -396,8 +396,13 @@ static int btintel_pcie_submit_rx(struct btintel_pcie_data *data) 
static int btintel_pcie_start_rx(struct btintel_pcie_data *data)

{

	int i, ret;

	struct rxq *rxq = &data->rxq;



	/* Post (BTINTEL_PCIE_RX_DESCS_COUNT - 3) buffers to overcome the

	 * hardware issues leading to race condition at the firmware.

	 */



	for (i = 0; i < BTINTEL_PCIE_RX_MAX_QUEUE; i++) {

	for (i = 0; i < rxq->count - 3; i++) {

		ret = btintel_pcie_submit_rx(data);

		if (ret)

			return ret;
@@ -1782,8 +1787,8 @@ static int btintel_pcie_alloc(struct btintel_pcie_data *data) 
	 *  + size of index * Number of queues(2) * type of index array(4)

	 *  + size of context information

	 */

	total = (sizeof(struct tfd) + sizeof(struct urbd0) + sizeof(struct frbd)

		+ sizeof(struct urbd1)) * BTINTEL_DESCS_COUNT;

	total = (sizeof(struct tfd) + sizeof(struct urbd0)) * BTINTEL_PCIE_TX_DESCS_COUNT;

	total += (sizeof(struct frbd) + sizeof(struct urbd1)) * BTINTEL_PCIE_RX_DESCS_COUNT;



	/* Add the sum of size of index array and size of ci struct */

	total += (sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES * 4) + sizeof(struct ctx_info);
@@ -1808,36 +1813,36 @@ static int btintel_pcie_alloc(struct btintel_pcie_data *data) 
	data->dma_v_addr = v_addr;



	/* Setup descriptor count */

	data->txq.count = BTINTEL_DESCS_COUNT;

	data->rxq.count = BTINTEL_DESCS_COUNT;

	data->txq.count = BTINTEL_PCIE_TX_DESCS_COUNT;

	data->rxq.count = BTINTEL_PCIE_RX_DESCS_COUNT;



	/* Setup tfds */

	data->txq.tfds_p_addr = p_addr;

	data->txq.tfds = v_addr;



	p_addr += (sizeof(struct tfd) * BTINTEL_DESCS_COUNT);

	v_addr += (sizeof(struct tfd) * BTINTEL_DESCS_COUNT);

	p_addr += (sizeof(struct tfd) * BTINTEL_PCIE_TX_DESCS_COUNT);

	v_addr += (sizeof(struct tfd) * BTINTEL_PCIE_TX_DESCS_COUNT);



	/* Setup urbd0 */

	data->txq.urbd0s_p_addr = p_addr;

	data->txq.urbd0s = v_addr;



	p_addr += (sizeof(struct urbd0) * BTINTEL_DESCS_COUNT);

	v_addr += (sizeof(struct urbd0) * BTINTEL_DESCS_COUNT);

	p_addr += (sizeof(struct urbd0) * BTINTEL_PCIE_TX_DESCS_COUNT);

	v_addr += (sizeof(struct urbd0) * BTINTEL_PCIE_TX_DESCS_COUNT);



	/* Setup FRBD*/

	data->rxq.frbds_p_addr = p_addr;

	data->rxq.frbds = v_addr;



	p_addr += (sizeof(struct frbd) * BTINTEL_DESCS_COUNT);

	v_addr += (sizeof(struct frbd) * BTINTEL_DESCS_COUNT);

	p_addr += (sizeof(struct frbd) * BTINTEL_PCIE_RX_DESCS_COUNT);

	v_addr += (sizeof(struct frbd) * BTINTEL_PCIE_RX_DESCS_COUNT);



	/* Setup urbd1 */

	data->rxq.urbd1s_p_addr = p_addr;

	data->rxq.urbd1s = v_addr;



	p_addr += (sizeof(struct urbd1) * BTINTEL_DESCS_COUNT);

	v_addr += (sizeof(struct urbd1) * BTINTEL_DESCS_COUNT);

	p_addr += (sizeof(struct urbd1) * BTINTEL_PCIE_RX_DESCS_COUNT);

	v_addr += (sizeof(struct urbd1) * BTINTEL_PCIE_RX_DESCS_COUNT);



	/* Setup data buffers for txq */

	err = btintel_pcie_setup_txq_bufs(data, &data->txq);

drivers/bluetooth/btintel_pcie.h

+5 −5
Original line number Diff line number Diff line
@@ -154,8 +154,11 @@ enum msix_mbox_int_causes { 
/* Default interrupt timeout in msec */

#define BTINTEL_DEFAULT_INTR_TIMEOUT_MS	3000



/* The number of descriptors in TX/RX queues */

#define BTINTEL_DESCS_COUNT	16

/* The number of descriptors in TX queues */

#define BTINTEL_PCIE_TX_DESCS_COUNT	32



/* The number of descriptors in RX queues */

#define BTINTEL_PCIE_RX_DESCS_COUNT	64



/* Number of Queue for TX and RX

 * It indicates the index of the IA(Index Array)
@@ -177,9 +180,6 @@ enum { 
/* Doorbell vector for TFD */

#define BTINTEL_PCIE_TX_DB_VEC	0



/* Number of pending RX requests for downlink */

#define BTINTEL_PCIE_RX_MAX_QUEUE	6



/* Doorbell vector for FRBD */

#define BTINTEL_PCIE_RX_DB_VEC	513

include/net/bluetooth/hci_core.h

+1 −1
Original line number Diff line number Diff line
@@ -546,6 +546,7 @@ struct hci_dev { 
	struct hci_conn_hash	conn_hash;



	struct list_head	mesh_pending;

	struct mutex		mgmt_pending_lock;

	struct list_head	mgmt_pending;

	struct list_head	reject_list;

	struct list_head	accept_list;
@@ -2400,7 +2401,6 @@ void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, 
			    u8 instance);

void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,

			      u8 instance);

void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle);

int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip);

void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,

				  bdaddr_t *bdaddr, u8 addr_type);

net/bluetooth/hci_core.c

+5 −11
Original line number Diff line number Diff line
@@ -1877,10 +1877,8 @@ void hci_free_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor) 
	if (monitor->handle)

		idr_remove(&hdev->adv_monitors_idr, monitor->handle);



	if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED) {

	if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED)

		hdev->adv_monitors_cnt--;

		mgmt_adv_monitor_removed(hdev, monitor->handle);

	}



	kfree(monitor);

}
@@ -2487,6 +2485,7 @@ struct hci_dev *hci_alloc_dev_priv(int sizeof_priv) 


	mutex_init(&hdev->lock);

	mutex_init(&hdev->req_lock);

	mutex_init(&hdev->mgmt_pending_lock);



	ida_init(&hdev->unset_handle_ida);
@@ -3417,23 +3416,18 @@ static void hci_link_tx_to(struct hci_dev *hdev, __u8 type) 


	bt_dev_err(hdev, "link tx timeout");



	rcu_read_lock();

	hci_dev_lock(hdev);



	/* Kill stalled connections */

	list_for_each_entry_rcu(c, &h->list, list) {

	list_for_each_entry(c, &h->list, list) {

		if (c->type == type && c->sent) {

			bt_dev_err(hdev, "killing stalled connection %pMR",

				   &c->dst);

			/* hci_disconnect might sleep, so, we have to release

			 * the RCU read lock before calling it.

			 */

			rcu_read_unlock();

			hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);

			rcu_read_lock();

		}

	}



	rcu_read_unlock();

	hci_dev_unlock(hdev);

}



static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,

net/bluetooth/mgmt.c

+60 −78
Original line number Diff line number Diff line
@@ -1447,22 +1447,17 @@ static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 


	send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);



	list_del(&cmd->list);



	if (match->sk == NULL) {

		match->sk = cmd->sk;

		sock_hold(match->sk);

	}



	mgmt_pending_free(cmd);

}



static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)

{

	u8 *status = data;



	mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);

	mgmt_pending_remove(cmd);

	mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, *status);

}



static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
@@ -1476,8 +1471,6 @@ static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 


	if (cmd->cmd_complete) {

		cmd->cmd_complete(cmd, match->mgmt_status);

		mgmt_pending_remove(cmd);



		return;

	}
@@ -1486,13 +1479,13 @@ static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 


static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)

{

	return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,

	return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status,

				 cmd->param, cmd->param_len);

}



static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)

{

	return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,

	return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status,

				 cmd->param, sizeof(struct mgmt_addr_info));

}
@@ -1532,7 +1525,7 @@ static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 


	if (err) {

		u8 mgmt_err = mgmt_status(err);

		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);

		mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);

		hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);

		goto done;

	}
@@ -1707,7 +1700,7 @@ static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 


	if (err) {

		u8 mgmt_err = mgmt_status(err);

		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);

		mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);

		goto done;

	}
@@ -1943,8 +1936,8 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 
			new_settings(hdev, NULL);

		}



		mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,

				     &mgmt_err);

		mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, true,

				     cmd_status_rsp, &mgmt_err);

		return;

	}
@@ -1954,7 +1947,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 
		changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);

	}



	mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);

	mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, true, settings_rsp, &match);



	if (changed)

		new_settings(hdev, match.sk);
@@ -2074,12 +2067,12 @@ static void set_le_complete(struct hci_dev *hdev, void *data, int err) 
	bt_dev_dbg(hdev, "err %d", err);



	if (status) {

		mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,

		mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, true, cmd_status_rsp,

				     &status);

		return;

	}



	mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);

	mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, true, settings_rsp, &match);



	new_settings(hdev, match.sk);
@@ -2138,7 +2131,7 @@ static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 
	struct sock *sk = cmd->sk;



	if (status) {

		mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev,

		mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev, true,

				     cmd_status_rsp, &status);

		return;

	}
@@ -2638,7 +2631,7 @@ static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 


	bt_dev_dbg(hdev, "err %d", err);



	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,

	mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,

			  mgmt_status(err), hdev->dev_class, 3);



	mgmt_pending_free(cmd);
@@ -3427,7 +3420,7 @@ static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 
	bacpy(&rp.addr.bdaddr, &conn->dst);

	rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);



	err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,

	err = mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_PAIR_DEVICE,

				status, &rp, sizeof(rp));



	/* So we don't get further callbacks for this connection */
@@ -5108,24 +5101,14 @@ static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 
	mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);

}



void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)

static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev,

				     u16 handle)

{

	struct mgmt_ev_adv_monitor_removed ev;

	struct mgmt_pending_cmd *cmd;

	struct sock *sk_skip = NULL;

	struct mgmt_cp_remove_adv_monitor *cp;



	cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);

	if (cmd) {

		cp = cmd->param;



		if (cp->monitor_handle)

			sk_skip = cmd->sk;

	}



	ev.monitor_handle = cpu_to_le16(handle);



	mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);

	mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk);

}



static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
@@ -5196,7 +5179,7 @@ static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 
		hci_update_passive_scan(hdev);

	}



	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,

	mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,

			  mgmt_status(status), &rp, sizeof(rp));

	mgmt_pending_remove(cmd);
@@ -5227,8 +5210,7 @@ static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 


	if (pending_find(MGMT_OP_SET_LE, hdev) ||

	    pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||

	    pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||

	    pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {

	    pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {

		status = MGMT_STATUS_BUSY;

		goto unlock;

	}
@@ -5398,8 +5380,7 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 
	struct mgmt_pending_cmd *cmd = data;

	struct mgmt_cp_remove_adv_monitor *cp;



	if (status == -ECANCELED ||

	    cmd != pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev))

	if (status == -ECANCELED)

		return;



	hci_dev_lock(hdev);
@@ -5408,12 +5389,14 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 


	rp.monitor_handle = cp->monitor_handle;



	if (!status)

	if (!status) {

		mgmt_adv_monitor_removed(cmd->sk, hdev, cp->monitor_handle);

		hci_update_passive_scan(hdev);

	}



	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,

	mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,

			  mgmt_status(status), &rp, sizeof(rp));

	mgmt_pending_remove(cmd);

	mgmt_pending_free(cmd);



	hci_dev_unlock(hdev);

	bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
@@ -5423,10 +5406,6 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 
static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)

{

	struct mgmt_pending_cmd *cmd = data;



	if (cmd != pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev))

		return -ECANCELED;



	struct mgmt_cp_remove_adv_monitor *cp = cmd->param;

	u16 handle = __le16_to_cpu(cp->monitor_handle);
@@ -5445,14 +5424,13 @@ static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 
	hci_dev_lock(hdev);



	if (pending_find(MGMT_OP_SET_LE, hdev) ||

	    pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||

	    pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||

	    pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {

		status = MGMT_STATUS_BUSY;

		goto unlock;

	}



	cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);

	cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);

	if (!cmd) {

		status = MGMT_STATUS_NO_RESOURCES;

		goto unlock;
@@ -5462,7 +5440,7 @@ static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 
				  mgmt_remove_adv_monitor_complete);



	if (err) {

		mgmt_pending_remove(cmd);

		mgmt_pending_free(cmd);



		if (err == -ENOMEM)

			status = MGMT_STATUS_NO_RESOURCES;
@@ -5792,7 +5770,7 @@ static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 
	    cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))

		return;



	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),

	mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err),

			  cmd->param, 1);

	mgmt_pending_remove(cmd);
@@ -6013,7 +5991,7 @@ static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 


	bt_dev_dbg(hdev, "err %d", err);



	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),

	mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err),

			  cmd->param, 1);

	mgmt_pending_remove(cmd);
@@ -6238,7 +6216,7 @@ static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 
	u8 status = mgmt_status(err);



	if (status) {

		mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,

		mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, true,

				     cmd_status_rsp, &status);

		return;

	}
@@ -6248,7 +6226,7 @@ static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 
	else

		hci_dev_clear_flag(hdev, HCI_ADVERTISING);



	mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,

	mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, true, settings_rsp,

			     &match);



	new_settings(hdev, match.sk);
@@ -6592,7 +6570,7 @@ static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 
		 */

		hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);



		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);

		mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);

	} else {

		send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);

		new_settings(hdev, cmd->sk);
@@ -6729,7 +6707,7 @@ static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 
	if (err) {

		u8 mgmt_err = mgmt_status(err);



		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);

		mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);

		goto done;

	}
@@ -7176,7 +7154,7 @@ static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 
		rp.max_tx_power = HCI_TX_POWER_INVALID;

	}



	mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,

	mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_GET_CONN_INFO, status,

			  &rp, sizeof(rp));



	mgmt_pending_free(cmd);
@@ -7336,7 +7314,7 @@ static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 
	}



complete:

	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,

	mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, &rp,

			  sizeof(rp));



	mgmt_pending_free(cmd);
@@ -8586,10 +8564,10 @@ static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 
	rp.instance = cp->instance;



	if (err)

		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,

		mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,

				mgmt_status(err));

	else

		mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,

		mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,

				  mgmt_status(err), &rp, sizeof(rp));



	add_adv_complete(hdev, cmd->sk, cp->instance, err);
@@ -8777,10 +8755,10 @@ static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 


		hci_remove_adv_instance(hdev, cp->instance);



		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,

		mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,

				mgmt_status(err));

	} else {

		mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,

		mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,

				  mgmt_status(err), &rp, sizeof(rp));

	}
@@ -8927,10 +8905,10 @@ static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 
	rp.instance = cp->instance;



	if (err)

		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,

		mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,

				mgmt_status(err));

	else

		mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,

		mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,

				  mgmt_status(err), &rp, sizeof(rp));



	mgmt_pending_free(cmd);
@@ -9089,10 +9067,10 @@ static void remove_advertising_complete(struct hci_dev *hdev, void *data, 
	rp.instance = cp->instance;



	if (err)

		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,

		mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,

				mgmt_status(err));

	else

		mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,

		mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,

				  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));



	mgmt_pending_free(cmd);
@@ -9364,7 +9342,7 @@ void mgmt_index_removed(struct hci_dev *hdev) 
	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))

		return;



	mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &match);

	mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match);



	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {

		mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0,
@@ -9402,7 +9380,8 @@ void mgmt_power_on(struct hci_dev *hdev, int err) 
		hci_update_passive_scan(hdev);

	}



	mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);

	mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp,

			     &match);



	new_settings(hdev, match.sk);
@@ -9417,7 +9396,8 @@ void __mgmt_power_off(struct hci_dev *hdev) 
	struct cmd_lookup match = { NULL, hdev };

	u8 zero_cod[] = { 0, 0, 0 };



	mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);

	mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp,

			     &match);



	/* If the power off is because of hdev unregistration let

	 * use the appropriate INVALID_INDEX status. Otherwise use
@@ -9431,7 +9411,7 @@ void __mgmt_power_off(struct hci_dev *hdev) 
	else

		match.mgmt_status = MGMT_STATUS_NOT_POWERED;



	mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &match);

	mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match);



	if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {

		mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
@@ -9672,7 +9652,6 @@ static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 
	device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);



	cmd->cmd_complete(cmd, 0);

	mgmt_pending_remove(cmd);

}



bool mgmt_powering_down(struct hci_dev *hdev)
@@ -9728,8 +9707,8 @@ void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 
	struct mgmt_cp_disconnect *cp;

	struct mgmt_pending_cmd *cmd;



	mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,

			     hdev);

	mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, true,

			     unpair_device_rsp, hdev);



	cmd = pending_find(MGMT_OP_DISCONNECT, hdev);

	if (!cmd)
@@ -9922,7 +9901,7 @@ void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 


	if (status) {

		u8 mgmt_err = mgmt_status(status);

		mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,

		mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true,

				     cmd_status_rsp, &mgmt_err);

		return;

	}
@@ -9932,8 +9911,8 @@ void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 
	else

		changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);



	mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,

			     &match);

	mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true,

			     settings_rsp, &match);



	if (changed)

		new_settings(hdev, match.sk);
@@ -9957,9 +9936,12 @@ void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 
{

	struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };



	mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);

	mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);

	mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);

	mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, false, sk_lookup,

			     &match);

	mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, false, sk_lookup,

			     &match);

	mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, false, sk_lookup,

			     &match);



	if (!status) {

		mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,