Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted

This attempts to cleanup the hci_conn if it cannot be aborted as otherwise it would likely result in having the controller and host stack out of sync with respect to connection handle.

Luiz Augusto von Dentz committed 4 years ago

Commit 9b3628d1 parent aef2aa44 files · +39 −19Browse files

Unified · Split

4 files

include/net/bluetooth/hci_core.h +1 −1
net/bluetooth/hci_conn.c +24 −8
net/bluetooth/hci_event.c +4 −9
net/bluetooth/hci_sync.c +10 −1

include/net/bluetooth/hci_core.h+1−1

@@ -1156,7 +1156,7 @@ int hci_conn_switch_role(struct hci_conn *conn, __u8 role); · 1155 unmodified lines
1156		1156
1157	void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);	1157	void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);
1158		1158
1159	void hci_le_conn_failed(struct hci_conn *conn, u8 status);	1159	void hci_conn_failed(struct hci_conn *conn, u8 status);
1160		1160
1161	/*	1161	/*
1162	* hci_conn_get() and hci_conn_put() are used to control the life-time of an	1162	* hci_conn_get() and hci_conn_put() are used to control the life-time of an

net/bluetooth/hci_conn.c+24−8

 		/* Disable LE Advertising */
 		le_disable_advertising(hdev);
 		hci_dev_lock(hdev);
-		hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
+		hci_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 		hci_dev_unlock(hdev);
 		return;
 	}
 EXPORT_SYMBOL(hci_get_route);
 /* This function requires the caller holds hdev->lock */
-void hci_le_conn_failed(struct hci_conn *conn, u8 status)
+static void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 {
 	struct hci_dev *hdev = conn->hdev;
 	struct hci_conn_params *params;
 		params->conn = NULL;
 	}
-	conn->state = BT_CLOSED;
 	/* If the status indicates successful cancellation of
 	 * the attempt (i.e. Unknown Connection Id) there's no point of
 	 * notifying failure since we'll go back to keep trying to
 		mgmt_connect_failed(hdev, &conn->dst, conn->type,
 				    conn->dst_type, status);
-	hci_connect_cfm(conn, status);
-	hci_conn_del(conn);
 	/* Since we may have temporarily stopped the background scanning in
 	 * favor of connection establishment, we should restart it.
 	 */
 	hci_enable_advertising(hdev);
 }
+/* This function requires the caller holds hdev->lock */
+void hci_conn_failed(struct hci_conn *conn, u8 status)
+{
+	struct hci_dev *hdev = conn->hdev;
+	bt_dev_dbg(hdev, "status 0x%2.2x", status);
+	switch (conn->type) {
+	case LE_LINK:
+		hci_le_conn_failed(conn, status);
+		break;
+	case ACL_LINK:
+		mgmt_connect_failed(hdev, &conn->dst, conn->type,
+				    conn->dst_type, status);
+		break;
+	}
+	conn->state = BT_CLOSED;
+	hci_connect_cfm(conn, status);
+	hci_conn_del(conn);
+}
 static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)
 {
 	struct hci_conn *conn = data;

net/bluetooth/hci_event.c+4−9

 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
 	/* All connection failure handling is taken care of by the
-	 * hci_le_conn_failed function which is triggered by the HCI
+	 * hci_conn_failed function which is triggered by the HCI
 	 * request completion callbacks used for connecting.
 	 */
 	if (status)
 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
 	/* All connection failure handling is taken care of by the
-	 * hci_le_conn_failed function which is triggered by the HCI
+	 * hci_conn_failed function which is triggered by the HCI
 	 * request completion callbacks used for connecting.
 	 */
 	if (status)
 done:
 	if (status) {
-		conn->state = BT_CLOSED;
+		hci_conn_failed(conn, status);
-		if (conn->type == ACL_LINK)
-			mgmt_connect_failed(hdev, &conn->dst, conn->type,
-					    conn->dst_type, status);
-		hci_connect_cfm(conn, status);
-		hci_conn_del(conn);
 	} else if (ev->link_type == SCO_LINK) {
 		switch (conn->setting & SCO_AIRMODE_MASK) {
 		case SCO_AIRMODE_CVSD:
 	}
 	if (status) {
-		hci_le_conn_failed(conn, status);
+		hci_conn_failed(conn, status);
 		goto unlock;
 	}

net/bluetooth/hci_sync.c+10−1

 static int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn,
 			       u8 reason)
 {
+	int err;
 	switch (conn->state) {
 	case BT_CONNECTED:
 	case BT_CONFIG:
 		return hci_disconnect_sync(hdev, conn, reason);
 	case BT_CONNECT:
-		return hci_connect_cancel_sync(hdev, conn);
+		err = hci_connect_cancel_sync(hdev, conn);
+		/* Cleanup hci_conn object if it cannot be cancelled as it
+		 * likelly means the controller and host stack are out of sync.
+		 */
+		if (err)
+			hci_conn_failed(conn, err);
+		return err;
 	case BT_CONNECT2:
 		return hci_reject_conn_sync(hdev, conn, reason);
 	default:

Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code