[v1] Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync

Commit Message

Luiz Augusto von Dentz March 26, 2024, 4:43 p.m. UTC

From: Luiz Augusto von Dentz <[e-mail]>

hci_cmd_sync_cancel_sync shall check the error passed to it since it
will be propagated using req_result which is __u32 it needs to be
properly set to a positive value if it was passed as negative othertise
IS_ERR will not trigger as -(errno) would be converted to a positive
value.

Fixes: 711c35949648 ("Bluetooth: hci_core: Cancel request on command timeout")
Signed-off-by: Luiz Augusto von Dentz <[e-mail]>
---
 net/bluetooth/hci_core.c | 6 +++---
 net/bluetooth/hci_sync.c | 5 ++++-
 2 files changed, 7 insertions(+), 4 deletions(-)

Comments

[e-mail] March 26, 2024, 5:31 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=838479

---Test result---

Test Summary:
CheckPatch                    PASS      1.28 seconds
GitLint                       PASS      0.28 seconds
SubjectPrefix                 PASS      0.10 seconds
BuildKernel                   PASS      29.04 seconds
CheckAllWarning               PASS      32.00 seconds
CheckSparse                   PASS      37.18 seconds
CheckSmatch                   PASS      100.34 seconds
BuildKernel32                 PASS      27.52 seconds
TestRunnerSetup               PASS      519.04 seconds
TestRunner_l2cap-tester       PASS      18.16 seconds
TestRunner_iso-tester         PASS      30.99 seconds
TestRunner_bnep-tester        PASS      4.87 seconds
TestRunner_mgmt-tester        PASS      114.43 seconds
TestRunner_rfcomm-tester      PASS      7.42 seconds
TestRunner_sco-tester         PASS      13.00 seconds
TestRunner_ioctl-tester       PASS      7.83 seconds
TestRunner_mesh-tester        PASS      5.94 seconds
TestRunner_smp-tester         PASS      6.92 seconds
TestRunner_userchan-tester    PASS      4.98 seconds
IncrementalBuild              PASS      26.02 seconds



---
Regards,
Linux Bluetooth

Thorsten Leemhuis March 26, 2024, 6:46 p.m. UTC | #2

On 26.03.24 17:43, Luiz Augusto von Dentz wrote:
> From: Luiz Augusto von Dentz <[e-mail]>
> 
> hci_cmd_sync_cancel_sync shall check the error passed to it since it
> will be propagated using req_result which is __u32 it needs to be
> properly set to a positive value if it was passed as negative othertise
> IS_ERR will not trigger as -(errno) would be converted to a positive
> value.
> 
> Fixes: 711c35949648 ("Bluetooth: hci_core: Cancel request on command timeout")
> Signed-off-by: Luiz Augusto von Dentz <[e-mail]>

This fixed my problem:

Reported-and-tested-by: Thorsten Leemhuis <[e-mail]>
Closes:
https://lore.kernel.org/all/[e-mail]/

Ciao, Thorsten

[e-mail] March 26, 2024, 7:50 p.m. UTC | #3

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[e-mail]>:

On Tue, 26 Mar 2024 12:43:17 -0400 you wrote:
> From: Luiz Augusto von Dentz <[e-mail]>
> 
> hci_cmd_sync_cancel_sync shall check the error passed to it since it
> will be propagated using req_result which is __u32 it needs to be
> properly set to a positive value if it was passed as negative othertise
> IS_ERR will not trigger as -(errno) would be converted to a positive
> value.
> 
> [...]

Here is the summary with links:
  - [v1] Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync
    https://git.kernel.org/bluetooth/bluetooth-next/c/e9c62fdc7f3e

You are awesome, thank you!

Patch

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 1690ae57a09d..a7028d38c1f5 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2874,7 +2874,7 @@  static void hci_cancel_cmd_sync(struct hci_dev *hdev, int err)
 	cancel_delayed_work_sync(&hdev->ncmd_timer);
 	atomic_set(&hdev->cmd_cnt, 1);
 
-	hci_cmd_sync_cancel_sync(hdev, -err);
+	hci_cmd_sync_cancel_sync(hdev, err);
 }
 
 /* Suspend HCI device */
@@ -2894,7 +2894,7 @@  int hci_suspend_dev(struct hci_dev *hdev)
 		return 0;
 
 	/* Cancel potentially blocking sync operation before suspend */
-	hci_cancel_cmd_sync(hdev, -EHOSTDOWN);
+	hci_cancel_cmd_sync(hdev, EHOSTDOWN);
 
 	hci_req_sync_lock(hdev);
 	ret = hci_suspend_sync(hdev);
@@ -4210,7 +4210,7 @@  static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)
 
 	err = hci_send_frame(hdev, skb);
 	if (err < 0) {
-		hci_cmd_sync_cancel_sync(hdev, err);
+		hci_cmd_sync_cancel_sync(hdev, -err);
 		return;
 	}
 
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 639090b9f4b8..8fe02921adf1 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -617,7 +617,10 @@  void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err)
 	bt_dev_dbg(hdev, "err 0x%2.2x", err);
 
 	if (hdev->req_status == HCI_REQ_PEND) {
-		hdev->req_result = err;
+		/* req_result is __u32 so error must be positive to be properly
+		 * propagated.
+		 */
+		hdev->req_result = err < 0 ? -err : err;
 		hdev->req_status = HCI_REQ_CANCELED;
 
 		wake_up_interruptible(&hdev->req_wait_q);