History

Merge tag 'for-net-2022-04-27' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fix regression causing some HCI events to be discarded when they shouldn't. * tag 'for-net-2022-04-27' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted Bluetooth: hci_event: Fix creating hci_conn object on error status Bluetooth: hci_event: Fix checking for invalid handle on error status ====================

Paolo Abeni committed 4 years ago

Commit febb2d22 parents d2b52ec 9b3628d5 files · +83 −43Browse files

Unified · Split

5 files
  1. include/net/bluetooth/hci.h +1 −0
  2. include/net/bluetooth/hci_core.h +1 −1
  3. net/bluetooth/hci_conn.c +24 −8
  4. net/bluetooth/hci_event.c +47 −33
  5. net/bluetooth/hci_sync.c +10 −1
include/net/bluetooth/hci.h+1−0
@@ -578,6 +578,7 @@ enum { · 577 unmodified lines
578#define HCI_ERROR_CONNECTION_TIMEOUT 0x08578#define HCI_ERROR_CONNECTION_TIMEOUT 0x08
579#define HCI_ERROR_REJ_LIMITED_RESOURCES 0x0d579#define HCI_ERROR_REJ_LIMITED_RESOURCES 0x0d
580#define HCI_ERROR_REJ_BAD_ADDR 0x0f580#define HCI_ERROR_REJ_BAD_ADDR 0x0f
581#define HCI_ERROR_INVALID_PARAMETERS 0x12
581#define HCI_ERROR_REMOTE_USER_TERM 0x13582#define HCI_ERROR_REMOTE_USER_TERM 0x13
582#define HCI_ERROR_REMOTE_LOW_RESOURCES 0x14583#define HCI_ERROR_REMOTE_LOW_RESOURCES 0x14
583#define HCI_ERROR_REMOTE_POWER_OFF 0x15584#define HCI_ERROR_REMOTE_POWER_OFF 0x15
include/net/bluetooth/hci_core.h+1−1
@@ -1156,7 +1156,7 @@ int hci_conn_switch_role(struct hci_conn *conn, __u8 role); · 1155 unmodified lines
1156 1156
1157void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);1157void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);
1158 1158
1159void hci_le_conn_failed(struct hci_conn *conn, u8 status);1159void hci_conn_failed(struct hci_conn *conn, u8 status);
1160 1160
1161/*1161/*
1162 * hci_conn_get() and hci_conn_put() are used to control the life-time of an1162 * hci_conn_get() and hci_conn_put() are used to control the life-time of an
net/bluetooth/hci_conn.c+24−8
@@ -670,7 +670,7 @@ static void le_conn_timeout(struct work_struct *work) · 669 unmodified lines
670 /* Disable LE Advertising */670 /* Disable LE Advertising */
671 le_disable_advertising(hdev);671 le_disable_advertising(hdev);
672 hci_dev_lock(hdev);672 hci_dev_lock(hdev);
673 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);673 hci_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
674 hci_dev_unlock(hdev);674 hci_dev_unlock(hdev);
675 return;675 return;
676 }676 }
@@ -873,7 +873,7 @@ struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type) · 196 unmodified lines
873EXPORT_SYMBOL(hci_get_route);873EXPORT_SYMBOL(hci_get_route);
874 874
875/* This function requires the caller holds hdev->lock */875/* This function requires the caller holds hdev->lock */
876void hci_le_conn_failed(struct hci_conn *conn, u8 status)876static void hci_le_conn_failed(struct hci_conn *conn, u8 status)
877{877{
878 struct hci_dev *hdev = conn->hdev;878 struct hci_dev *hdev = conn->hdev;
879 struct hci_conn_params *params;879 struct hci_conn_params *params;
@@ -886,8 +886,6 @@ void hci_le_conn_failed(struct hci_conn *conn, u8 status) · 6 unmodified lines
886 params->conn = NULL;886 params->conn = NULL;
887 }887 }
888 888
889 conn->state = BT_CLOSED;
890
891 /* If the status indicates successful cancellation of889 /* If the status indicates successful cancellation of
892 * the attempt (i.e. Unknown Connection Id) there's no point of890 * the attempt (i.e. Unknown Connection Id) there's no point of
893 * notifying failure since we'll go back to keep trying to891 * notifying failure since we'll go back to keep trying to
@@ -899,10 +897,6 @@ void hci_le_conn_failed(struct hci_conn *conn, u8 status) · 5 unmodified lines
899 mgmt_connect_failed(hdev, &conn->dst, conn->type,897 mgmt_connect_failed(hdev, &conn->dst, conn->type,
900 conn->dst_type, status);898 conn->dst_type, status);
901 899
902 hci_connect_cfm(conn, status);
903
904 hci_conn_del(conn);
905
906 /* Since we may have temporarily stopped the background scanning in900 /* Since we may have temporarily stopped the background scanning in
907 * favor of connection establishment, we should restart it.901 * favor of connection establishment, we should restart it.
908 */902 */
@@ -914,6 +908,28 @@ void hci_le_conn_failed(struct hci_conn *conn, u8 status) · 5 unmodified lines
914 hci_enable_advertising(hdev);908 hci_enable_advertising(hdev);
915}909}
916 910
911/* This function requires the caller holds hdev->lock */
912void hci_conn_failed(struct hci_conn *conn, u8 status)
913{
914 struct hci_dev *hdev = conn->hdev;
915
916 bt_dev_dbg(hdev, "status 0x%2.2x", status);
917
918 switch (conn->type) {
919 case LE_LINK:
920 hci_le_conn_failed(conn, status);
921 break;
922 case ACL_LINK:
923 mgmt_connect_failed(hdev, &conn->dst, conn->type,
924 conn->dst_type, status);
925 break;
926 }
927
928 conn->state = BT_CLOSED;
929 hci_connect_cfm(conn, status);
930 hci_conn_del(conn);
931}
932
917static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)933static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)
918{934{
919 struct hci_conn *conn = data;935 struct hci_conn *conn = data;
net/bluetooth/hci_event.c+47−33
@@ -2834,7 +2834,7 @@ static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status) · 2833 unmodified lines
2834 bt_dev_dbg(hdev, "status 0x%2.2x", status);2834 bt_dev_dbg(hdev, "status 0x%2.2x", status);
2835 2835
2836 /* All connection failure handling is taken care of by the2836 /* All connection failure handling is taken care of by the
2837 * hci_le_conn_failed function which is triggered by the HCI2837 * hci_conn_failed function which is triggered by the HCI
2838 * request completion callbacks used for connecting.2838 * request completion callbacks used for connecting.
2839 */2839 */
2840 if (status)2840 if (status)
@@ -2859,7 +2859,7 @@ static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status) · 18 unmodified lines
2859 bt_dev_dbg(hdev, "status 0x%2.2x", status);2859 bt_dev_dbg(hdev, "status 0x%2.2x", status);
2860 2860
2861 /* All connection failure handling is taken care of by the2861 /* All connection failure handling is taken care of by the
2862 * hci_le_conn_failed function which is triggered by the HCI2862 * hci_conn_failed function which is triggered by the HCI
2863 * request completion callbacks used for connecting.2863 * request completion callbacks used for connecting.
2864 */2864 */
2865 if (status)2865 if (status)
@@ -3067,18 +3067,20 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, · 201 unmodified lines
3067{3067{
3068 struct hci_ev_conn_complete *ev = data;3068 struct hci_ev_conn_complete *ev = data;
3069 struct hci_conn *conn;3069 struct hci_conn *conn;
3070 u8 status = ev->status;
3070 3071
3071 if (__le16_to_cpu(ev->handle) > HCI_CONN_HANDLE_MAX) {3072 bt_dev_dbg(hdev, "status 0x%2.2x", status);
3072 bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for invalid handle");
3073 return;
3074 }
3075
3076 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3077 3073
3078 hci_dev_lock(hdev);3074 hci_dev_lock(hdev);
3079 3075
3080 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);3076 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3081 if (!conn) {3077 if (!conn) {
3078 /* In case of error status and there is no connection pending
3079 * just unlock as there is nothing to cleanup.
3080 */
3081 if (ev->status)
3082 goto unlock;
3083
3082 /* Connection may not exist if auto-connected. Check the bredr3084 /* Connection may not exist if auto-connected. Check the bredr
3083 * allowlist to see if this device is allowed to auto connect.3085 * allowlist to see if this device is allowed to auto connect.
3084 * If link is an ACL type, create a connection class3086 * If link is an ACL type, create a connection class
@@ -3122,8 +3124,14 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, · 37 unmodified lines
3122 goto unlock;3124 goto unlock;
3123 }3125 }
3124 3126
3125 if (!ev->status) {3127 if (!status) {
3126 conn->handle = __le16_to_cpu(ev->handle);3128 conn->handle = __le16_to_cpu(ev->handle);
3129 if (conn->handle > HCI_CONN_HANDLE_MAX) {
3130 bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x",
3131 conn->handle, HCI_CONN_HANDLE_MAX);
3132 status = HCI_ERROR_INVALID_PARAMETERS;
3133 goto done;
3134 }
3127 3135
3128 if (conn->type == ACL_LINK) {3136 if (conn->type == ACL_LINK) {
3129 conn->state = BT_CONFIG;3137 conn->state = BT_CONFIG;
@@ -3164,19 +3172,14 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, · 34 unmodified lines
3164 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),3172 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
3165 &cp);3173 &cp);
3166 }3174 }
3167 } else {
3168 conn->state = BT_CLOSED;
3169 if (conn->type == ACL_LINK)
3170 mgmt_connect_failed(hdev, &conn->dst, conn->type,
3171 conn->dst_type, ev->status);
3172 }3175 }
3173 3176
3174 if (conn->type == ACL_LINK)3177 if (conn->type == ACL_LINK)
3175 hci_sco_setup(conn, ev->status);3178 hci_sco_setup(conn, ev->status);
3176 3179
3177 if (ev->status) {3180done:
3178 hci_connect_cfm(conn, ev->status);3181 if (status) {
3179 hci_conn_del(conn);3182 hci_conn_failed(conn, status);
3180 } else if (ev->link_type == SCO_LINK) {3183 } else if (ev->link_type == SCO_LINK) {
3181 switch (conn->setting & SCO_AIRMODE_MASK) {3184 switch (conn->setting & SCO_AIRMODE_MASK) {
3182 case SCO_AIRMODE_CVSD:3185 case SCO_AIRMODE_CVSD:
@@ -3185,7 +3188,7 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, · 2 unmodified lines
3185 break;3188 break;
3186 }3189 }
3187 3190
3188 hci_connect_cfm(conn, ev->status);3191 hci_connect_cfm(conn, status);
3189 }3192 }
3190 3193
3191unlock:3194unlock:
@@ -4676,6 +4679,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data, · 1484 unmodified lines
4676{4679{
4677 struct hci_ev_sync_conn_complete *ev = data;4680 struct hci_ev_sync_conn_complete *ev = data;
4678 struct hci_conn *conn;4681 struct hci_conn *conn;
4682 u8 status = ev->status;
4679 4683
4680 switch (ev->link_type) {4684 switch (ev->link_type) {
4681 case SCO_LINK:4685 case SCO_LINK:
@@ -4690,12 +4694,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data, · 8 unmodified lines
4690 return;4694 return;
4691 }4695 }
4692 4696
4693 if (__le16_to_cpu(ev->handle) > HCI_CONN_HANDLE_MAX) {4697 bt_dev_dbg(hdev, "status 0x%2.2x", status);
4694 bt_dev_err(hdev, "Ignoring HCI_Sync_Conn_Complete for invalid handle");
4695 return;
4696 }
4697
4698 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4699 4698
4700 hci_dev_lock(hdev);4699 hci_dev_lock(hdev);
4701 4700
@@ -4729,9 +4728,17 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data, · 27 unmodified lines
4729 goto unlock;4728 goto unlock;
4730 }4729 }
4731 4730
4732 switch (ev->status) {4731 switch (status) {
4733 case 0x00:4732 case 0x00:
4734 conn->handle = __le16_to_cpu(ev->handle);4733 conn->handle = __le16_to_cpu(ev->handle);
4734 if (conn->handle > HCI_CONN_HANDLE_MAX) {
4735 bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x",
4736 conn->handle, HCI_CONN_HANDLE_MAX);
4737 status = HCI_ERROR_INVALID_PARAMETERS;
4738 conn->state = BT_CLOSED;
4739 break;
4740 }
4741
4735 conn->state = BT_CONNECTED;4742 conn->state = BT_CONNECTED;
4736 conn->type = ev->link_type;4743 conn->type = ev->link_type;
4737 4744
@@ -4775,8 +4782,8 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data, · 37 unmodified lines
4775 }4782 }
4776 }4783 }
4777 4784
4778 hci_connect_cfm(conn, ev->status);4785 hci_connect_cfm(conn, status);
4779 if (ev->status)4786 if (status)
4780 hci_conn_del(conn);4787 hci_conn_del(conn);
4781 4788
4782unlock:4789unlock:
@@ -5527,11 +5534,6 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, · 744 unmodified lines
5527 struct smp_irk *irk;5534 struct smp_irk *irk;
5528 u8 addr_type;5535 u8 addr_type;
5529 5536
5530 if (handle > HCI_CONN_HANDLE_MAX) {
5531 bt_dev_err(hdev, "Ignoring HCI_LE_Connection_Complete for invalid handle");
5532 return;
5533 }
5534
5535 hci_dev_lock(hdev);5537 hci_dev_lock(hdev);
5536 5538
5537 /* All controllers implicitly stop advertising in the event of a5539 /* All controllers implicitly stop advertising in the event of a
@@ -5541,6 +5543,12 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, · 3 unmodified lines
5541 5543
5542 conn = hci_lookup_le_connect(hdev);5544 conn = hci_lookup_le_connect(hdev);
5543 if (!conn) {5545 if (!conn) {
5546 /* In case of error status and there is no connection pending
5547 * just unlock as there is nothing to cleanup.
5548 */
5549 if (status)
5550 goto unlock;
5551
5544 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);5552 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
5545 if (!conn) {5553 if (!conn) {
5546 bt_dev_err(hdev, "no memory for new connection");5554 bt_dev_err(hdev, "no memory for new connection");
@@ -5603,8 +5611,14 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, · 56 unmodified lines
5603 5611
5604 conn->dst_type = ev_bdaddr_type(hdev, conn->dst_type, NULL);5612 conn->dst_type = ev_bdaddr_type(hdev, conn->dst_type, NULL);
5605 5613
5614 if (handle > HCI_CONN_HANDLE_MAX) {
5615 bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x", handle,
5616 HCI_CONN_HANDLE_MAX);
5617 status = HCI_ERROR_INVALID_PARAMETERS;
5618 }
5619
5606 if (status) {5620 if (status) {
5607 hci_le_conn_failed(conn, status);5621 hci_conn_failed(conn, status);
5608 goto unlock;5622 goto unlock;
5609 }5623 }
5610 5624
net/bluetooth/hci_sync.c+10−1
@@ -4408,12 +4408,21 @@ static int hci_reject_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, · 4407 unmodified lines
4408static int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn,4408static int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn,
4409 u8 reason)4409 u8 reason)
4410{4410{
4411 int err;
4412
4411 switch (conn->state) {4413 switch (conn->state) {
4412 case BT_CONNECTED:4414 case BT_CONNECTED:
4413 case BT_CONFIG:4415 case BT_CONFIG:
4414 return hci_disconnect_sync(hdev, conn, reason);4416 return hci_disconnect_sync(hdev, conn, reason);
4415 case BT_CONNECT:4417 case BT_CONNECT:
4416 return hci_connect_cancel_sync(hdev, conn);4418 err = hci_connect_cancel_sync(hdev, conn);
4419 /* Cleanup hci_conn object if it cannot be cancelled as it
4420 * likelly means the controller and host stack are out of sync.
4421 */
4422 if (err)
4423 hci_conn_failed(conn, err);
4424
4425 return err;
4417 case BT_CONNECT2:4426 case BT_CONNECT2:
4418 return hci_reject_conn_sync(hdev, conn, reason);4427 return hci_reject_conn_sync(hdev, conn, reason);
4419 default:4428 default:

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t