[PATCH v1] Bluetooth: mgmt: always reply when a queued mgmt command is cancelled

[PATCH v1] Bluetooth: mgmt: always reply when a queued mgmt command is cancelled

[Shuai Zhang]

On boot, the kernel's HCI_AUTO_OFF timer powers a newly probed
controller back off after 2 seconds if nothing has taken ownership of
it yet. bluetooth.service is expected to take ownership within that
window by powering the adapter on, but on slower boots bluetoothd can
start late enough that the two race: HCI_AUTO_OFF fires and the
controller is torn down and re-initialised while bluetoothd is still
in the middle of its own adapter setup sequence.

When that teardown happens, any mgmt command bluetoothd had already
queued for that adapter is cancelled - but userspace is never told.
bluez's mgmt command queue is strictly serialised, so a command that
never receives a reply blocks every command queued after it on that
adapter indefinitely. In practice this means bluetoothd gets stuck
before it can register the adapter, and reports no controller being
available at all, even though the controller itself is healthy and
fully usable moments later.

Fix this by treating a cancelled command like any other failure
instead of silently dropping it: always send a reply back to
userspace, using the existing "cancelled" status value. This mirrors
how other mgmt commands already behave when they fail for other
reasons, and lets bluetoothd's normal error handling take over
(log the failure and continue) instead of hanging forever.

Verified on a QCS6490 rb3gen2 board where this HCI_AUTO_OFF vs.
bluetooth.service race was reproduced: before this change, hitting
the race left the adapter permanently unavailable to bluetoothd until
the service was restarted; after this change, hitting the same race
no longer affects adapter registration and the controller comes up
normally.

Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
---
 net/bluetooth/mgmt.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 167d75e34..9031b5d5d 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -301,6 +301,8 @@ static u8 mgmt_errno_status(int err)
 		return MGMT_STATUS_ALREADY_CONNECTED;
 	case -ENOTCONN:
 		return MGMT_STATUS_DISCONNECTED;
+	case -ECANCELED:
+		return MGMT_STATUS_CANCELLED;
 	}
 
 	return MGMT_STATUS_FAILED;
@@ -1338,7 +1340,7 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
 	struct mgmt_mode *cp;
 
 	/* Make sure cmd still outstanding. */
-	if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
+	if (!mgmt_pending_valid(hdev, cmd))
 		return;
 
 	cp = cmd->param;
@@ -5651,9 +5653,6 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
 	struct mgmt_pending_cmd *cmd = data;
 	struct mgmt_cp_remove_adv_monitor *cp;
 
-	if (status == -ECANCELED)
-		return;
-
 	hci_dev_lock(hdev);
 
 	cp = cmd->param;
-- 
2.34.1

RE: [v1] Bluetooth: mgmt: always reply when a queued mgmt command is cancelled

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2064 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1137868

---Test result---

Test Summary:
CheckPatch                    PASS      0.72 seconds
VerifyFixes                   PASS      0.13 seconds
VerifySignedoff               PASS      0.13 seconds
GitLint                       PASS      0.34 seconds
SubjectPrefix                 PASS      0.14 seconds
BuildKernel                   PASS      25.80 seconds
CheckAllWarning               PASS      28.43 seconds
CheckSparse                   PASS      27.16 seconds
BuildKernel32                 PASS      25.36 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      472.56 seconds
TestRunner_mgmt-tester        FAIL      227.65 seconds
TestRunner_mesh-tester        FAIL      27.03 seconds
IncrementalBuild              PASS      24.56 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 501, Passed: 488 (97.4%), Failed: 3, Not Run: 10

Failed Test Cases
Set Low Energy on 6.2 - SCI Setting                  Failed       0.364 seconds
Read Exp Feature - Success                           Failed       0.244 seconds
LL Privacy - Set Flags 3 (2 Devices to RL)           Failed       0.468 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Timed out    2.681 seconds
Mesh - Send cancel - 2                               Timed out    1.989 seconds


https://github.com/bluez/bluetooth-next/pull/521

---
Regards,
Linux Bluetooth