[PATCH v3] Bluetooth: mgmt: reply to cancelled mgmt commands instead of silently dropping

[PATCH v3] Bluetooth: mgmt: reply to cancelled mgmt commands instead of silently dropping

[Shuai Zhang]

The kernel sets HCI_AUTO_OFF when a controller is first registered and
starts a 2-second timer. On slower boots bluetoothd and the HCI_AUTO_OFF
timer can race: hci_power_off() is already queued while bluetoothd is
still in the middle of its adapter setup sequence. hci_cmd_sync_clear()
then cancels any pending mgmt commands with -ECANCELED, including the
MGMT_OP_REMOVE_ADV_MONITOR sent by reset_adv_monitors() early in the
setup sequence.

When auto_off=1, hci_dev_close_sync() skips __mgmt_power_off() entirely,
so there is no fallback path to reply to the cancelled commands.
mgmt_remove_adv_monitor_complete() silently returns on -ECANCELED, leaving
the command with no reply. Since bluez's mgmt queue is strictly serialised,
this stalls all subsequent commands indefinitely, leaving bluetoothd unable
to register the adapter.

Fix by mapping -ECANCELED to MGMT_STATUS_CANCELLED in mgmt_errno_status()
and replying to the cancelled command in mgmt_remove_adv_monitor_complete()
instead of returning early.

Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
---
Changes in v3:
- Reply to the cancelled command without taking hdev->lock. The
  cancellation path runs from hci_cmd_sync_clear() with
  cmd_sync_work_lock held, so taking hdev->lock here would form an
  AB-BA deadlock against the remove_adv_monitor() submission path
  (flagged by Sashiko). The success path is left unchanged.
- Link to v2: https://lore.kernel.org/all/20260817060134.3298439-1-shuai.zhang@oss.qualcomm.com/

Changes in v2:
- Drop the mgmt_set_powered_complete() hunk; that -ECANCELED early
  return is intentional and its reply is already handled elsewhere.
  Keep only mgmt_errno_status() and mgmt_remove_adv_monitor_complete()
  (per Luiz's review).
- Link to v1: https://lore.kernel.org/all/20260731042920.2431343-1-shuai.zhang@oss.qualcomm.com/

 net/bluetooth/mgmt.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index ac4864e56..fd045460e 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -301,6 +301,8 @@ static u8 mgmt_errno_status(int err)
 		return MGMT_STATUS_ALREADY_CONNECTED;
 	case -ENOTCONN:
 		return MGMT_STATUS_DISCONNECTED;
+	case -ECANCELED:
+		return MGMT_STATUS_CANCELLED;
 	}
 
 	return MGMT_STATUS_FAILED;
@@ -5675,8 +5677,18 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
 	struct mgmt_pending_cmd *cmd = data;
 	struct mgmt_cp_remove_adv_monitor *cp;
 
-	if (status == -ECANCELED)
+	/* Reply to a cancelled command so bluetoothd's serialised mgmt queue
+	 * is not blocked.
+	 */
+	if (status == -ECANCELED) {
+		cp = cmd->param;
+		rp.monitor_handle = cp->monitor_handle;
+
+		mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
+				  mgmt_status(status), &rp, sizeof(rp));
+		mgmt_pending_free(cmd);
 		return;
+	}
 
 	hci_dev_lock(hdev);
 
-- 
2.34.1

RE: [v3] Bluetooth: mgmt: reply to cancelled mgmt commands instead of silently dropping

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2192 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1147775

---Test result---

Test Summary:
CheckPatch                    PASS      0.65 seconds
VerifyFixes                   PASS      0.12 seconds
VerifySignedoff               PASS      0.12 seconds
GitLint                       FAIL      0.29 seconds
SubjectPrefix                 PASS      0.11 seconds
BuildKernel                   PASS      25.72 seconds
CheckAllWarning               PASS      28.34 seconds
CheckSparse                   PASS      27.00 seconds
BuildKernel32                 PASS      24.52 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      465.28 seconds
TestRunner_mgmt-tester        FAIL      235.64 seconds
TestRunner_mesh-tester        FAIL      26.14 seconds
IncrementalBuild              PASS      23.47 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v3] Bluetooth: mgmt: reply to cancelled mgmt commands instead of silently dropping

1: T1 Title exceeds max length (83>80): "[v3] Bluetooth: mgmt: reply to cancelled mgmt commands instead of silently dropping"
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4

Failed Test Cases
Read Exp Feature - Success                           Failed       0.271 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Timed out    2.340 seconds
Mesh - Send cancel - 2                               Timed out    1.984 seconds


https://github.com/bluez/bluetooth-next/pull/609

---
Regards,
Linux Bluetooth

Re: [PATCH v3] Bluetooth: mgmt: reply to cancelled mgmt commands instead of silently dropping

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 18 Aug 2026 19:41:16 +0800 you wrote:
> The kernel sets HCI_AUTO_OFF when a controller is first registered and
> starts a 2-second timer. On slower boots bluetoothd and the HCI_AUTO_OFF
> timer can race: hci_power_off() is already queued while bluetoothd is
> still in the middle of its adapter setup sequence. hci_cmd_sync_clear()
> then cancels any pending mgmt commands with -ECANCELED, including the
> MGMT_OP_REMOVE_ADV_MONITOR sent by reset_adv_monitors() early in the
> setup sequence.
> 
> [...]

Here is the summary with links:
  - [v3] Bluetooth: mgmt: reply to cancelled mgmt commands instead of silently dropping
    https://git.kernel.org/bluetooth/bluetooth-next/c/b03f74d42e24

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html