diff mbox series

[BlueZ] vhci: Check whether vhci open setup succeeded

Message ID 20230920184313.973822-1-arkadiusz.bokowy@gmail.com (mailing list archive)
State Accepted
Commit a2d47ef0522663fbd3887d198196647e28d2cf3c
Headers show
Series [BlueZ] vhci: Check whether vhci open setup succeeded | expand

Checks

Context Check Description
tedd_an/pre-ci_am success Success
tedd_an/CheckPatch success CheckPatch PASS
tedd_an/GitLint success Gitlint PASS
tedd_an/BuildEll success Build ELL PASS
tedd_an/BluezMake success Bluez Make PASS
tedd_an/MakeCheck success Bluez Make Check PASS
tedd_an/MakeDistcheck success Make Distcheck PASS
tedd_an/CheckValgrind success Check Valgrind PASS
tedd_an/CheckSmatch success CheckSparse PASS
tedd_an/bluezmakeextell success Make External ELL PASS
tedd_an/IncrementalBuild success Incremental Build PASS
tedd_an/ScanBuild success Scan Build PASS

Commit Message

Arkadiusz Bokowy Sept. 20, 2023, 6:43 p.m. UTC 
Due to race condition in the vhci kernel driver, we might read not a
vendor response packet, but a HCI reset command. This extra check will
ensure that kernel driver behaves correctly. Otherwise, the HCI setup
process will fail, because our controller will not respond to "missing"
HCI reset command. In result the virtual HCI will be DOWN and without
initialized Bluetooth address, e.g:

> hciconfig
hci2:   Type: Primary  Bus: Virtual
        BD Address: 00:AA:01:01:00:02  ACL MTU: 192:1  SCO MTU: 0:0
        UP RUNNING
        RX bytes:0 acl:0 sco:0 events:66 errors:0
        TX bytes:3086 acl:0 sco:0 commands:66 errors:0

hci1:   Type: Primary  Bus: Virtual
        BD Address: 00:00:00:00:00:00  ACL MTU: 0:0  SCO MTU: 0:0
        DOWN
        RX bytes:0 acl:0 sco:0 events:0 errors:0
        TX bytes:8 acl:0 sco:0 commands:1 errors:0

> dmesg
[1754256.640122] Bluetooth: MGMT ver 1.22
[1754263.023806] Bluetooth: MGMT ver 1.22
[1754265.043775] Bluetooth: hci1: Opcode 0x c03 failed: -110
---
 emulator/vhci.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

bluez.test.bot@gmail.com Sept. 20, 2023, 8:13 p.m. UTC | #1 
This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=786046

---Test result---

Test Summary:
CheckPatch                    PASS      0.55 seconds
GitLint                       PASS      0.38 seconds
BuildEll                      PASS      28.85 seconds
BluezMake                     PASS      907.25 seconds
MakeCheck                     PASS      12.89 seconds
MakeDistcheck                 PASS      161.41 seconds
CheckValgrind                 PASS      264.06 seconds
CheckSmatch                   PASS      358.21 seconds
bluezmakeextell               PASS      108.27 seconds
IncrementalBuild              PASS      730.15 seconds
ScanBuild                     PASS      1093.08 seconds



---
Regards,
Linux Bluetooth
patchwork-bot+bluetooth@kernel.org Sept. 20, 2023, 9 p.m. UTC | #2 
Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed, 20 Sep 2023 20:43:13 +0200 you wrote:
> Due to race condition in the vhci kernel driver, we might read not a
> vendor response packet, but a HCI reset command. This extra check will
> ensure that kernel driver behaves correctly. Otherwise, the HCI setup
> process will fail, because our controller will not respond to "missing"
> HCI reset command. In result the virtual HCI will be DOWN and without
> initialized Bluetooth address, e.g:
> 
> [...]

Here is the summary with links:
  - [BlueZ] vhci: Check whether vhci open setup succeeded
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=a2d47ef05226

You are awesome, thank you!
diff mbox series

Patch

diff --git a/emulator/vhci.c b/emulator/vhci.c
index 7b363009a..355ab6389 100644
--- a/emulator/vhci.c
+++ b/emulator/vhci.c
@@ -122,14 +122,16 @@  struct vhci *vhci_open(uint8_t type)
 		break;
 	}
 
-	if (write(fd, &req, sizeof(req)) < 0) {
+	if (write(fd, &req, sizeof(req)) != sizeof(req)) {
 		close(fd);
 		return NULL;
 	}
 
 	memset(&rsp, 0, sizeof(rsp));
 
-	if (read(fd, &rsp, sizeof(rsp)) < 0) {
+	if (read(fd, &rsp, sizeof(rsp)) != sizeof(rsp) ||
+			rsp.pkt_type != HCI_VENDOR_PKT ||
+			rsp.opcode != req.opcode) {
 		close(fd);
 		return NULL;
 	}