mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 12:57:53 +00:00
Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync
commit 1c3366abdbe884be62e5a7502b4db758aa3974c6 upstream.
hci_cmd_sync_cancel_sync shall check the error passed to it since it
will be propagated using req_result which is __u32 it needs to be
properly set to a positive value if it was passed as negative othertise
IS_ERR will not trigger as -(errno) would be converted to a positive
value.
Fixes: 63298d6e75
("Bluetooth: hci_core: Cancel request on command timeout")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Reported-and-tested-by: Thorsten Leemhuis <linux@leemhuis.info>
Closes: https://lore.kernel.org/all/08275279-7462-4f4a-a0ee-8aa015f829bc@leemhuis.info/
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
f6e163e9c3
commit
b0a3738c0b
2 changed files with 7 additions and 4 deletions
|
@ -2842,7 +2842,7 @@ static void hci_cancel_cmd_sync(struct hci_dev *hdev, int err)
|
|||
cancel_delayed_work_sync(&hdev->ncmd_timer);
|
||||
atomic_set(&hdev->cmd_cnt, 1);
|
||||
|
||||
hci_cmd_sync_cancel_sync(hdev, -err);
|
||||
hci_cmd_sync_cancel_sync(hdev, err);
|
||||
}
|
||||
|
||||
/* Suspend HCI device */
|
||||
|
@ -2862,7 +2862,7 @@ int hci_suspend_dev(struct hci_dev *hdev)
|
|||
return 0;
|
||||
|
||||
/* Cancel potentially blocking sync operation before suspend */
|
||||
hci_cancel_cmd_sync(hdev, -EHOSTDOWN);
|
||||
hci_cancel_cmd_sync(hdev, EHOSTDOWN);
|
||||
|
||||
hci_req_sync_lock(hdev);
|
||||
ret = hci_suspend_sync(hdev);
|
||||
|
@ -4178,7 +4178,7 @@ static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)
|
|||
|
||||
err = hci_send_frame(hdev, skb);
|
||||
if (err < 0) {
|
||||
hci_cmd_sync_cancel_sync(hdev, err);
|
||||
hci_cmd_sync_cancel_sync(hdev, -err);
|
||||
return;
|
||||
}
|
||||
|
||||
|
|
|
@ -611,7 +611,10 @@ void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err)
|
|||
bt_dev_dbg(hdev, "err 0x%2.2x", err);
|
||||
|
||||
if (hdev->req_status == HCI_REQ_PEND) {
|
||||
hdev->req_result = err;
|
||||
/* req_result is __u32 so error must be positive to be properly
|
||||
* propagated.
|
||||
*/
|
||||
hdev->req_result = err < 0 ? -err : err;
|
||||
hdev->req_status = HCI_REQ_CANCELED;
|
||||
|
||||
wake_up_interruptible(&hdev->req_wait_q);
|
||||
|
|
Loading…
Reference in a new issue