[PATCH] Bluetooth: MGMT: Fix status of pending commands flushed on power off

[PATCH] Bluetooth: MGMT: Fix status of pending commands flushed on power off

[Iaroslav Voitovych]

cmd_complete_rsp() receives a struct cmd_lookup and, for a pending
command that has no cmd_complete callback, falls through to
cmd_status_rsp(cmd, data). cmd_status_rsp() reads data as a u8 *, so
the status sent comes from the first byte of match->sk's
representation, not from match->mgmt_status.

commit f53e1c9c726d ("Bluetooth: MGMT: Fix possible crash on
mgmt_index_removed") changed the callers' data from &status to &match
and updated the cmd_complete branch to match->mgmt_status, but left
the fall-through passing data unchanged.

In mgmt_index_removed() match->sk is NULL, so every such command is
answered with status 0x00 (Success) instead of
MGMT_STATUS_INVALID_INDEX. In __mgmt_power_off() it is NULL too,
unless a Set Powered command was pending: then settings_rsp() has
stored that command's socket in match->sk, and the byte sent comes
from the socket pointer. Either way the status the caller set,
MGMT_STATUS_NOT_POWERED (or MGMT_STATUS_INVALID_INDEX when the device
is being unregistered), is lost.

Pass the status the callers set.

This was seen on a QCA9377 laptop: bluetoothd's Start Discovery,
pending when the adapter was powered off, was answered with Command
Status 0x00 and no parameters, and bluetoothd 5.72 crashed on the
zero-length success. BlueZ master has since added the length check
on that path ("adapter: Fix crash on short start discovery reply",
BlueZ a734b06059cb), but userspace should still be told Not Powered,
not Success.

Tested on Ubuntu 7.0.0-31 with a virtual controller (hci_vhci):
power off is held in HCI Write Scan Enable while a Start Discovery is
submitted, and the flush answers it with status 0x00 before this
change and 0x0f (Not Powered) after.

Fixes: f53e1c9c726d ("Bluetooth: MGMT: Fix possible crash on mgmt_index_removed")
Cc: stable@vger.kernel.org
Signed-off-by: Iaroslav Voitovych <yaroslav.voytovych@gmail.com>
---
 net/bluetooth/mgmt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 41956cdde982..251a896babd5 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1495,7 +1495,7 @@ static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
 		return;
 	}
 
-	cmd_status_rsp(cmd, data);
+	cmd_status_rsp(cmd, &match->mgmt_status);
 }
 
 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)

base-commit: c9c15d4d8956df8c564f7c210e4dc5b9b820d97a
-- 
2.43.0

RE: Bluetooth: MGMT: Fix status of pending commands flushed on power off

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1479 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1173305/

---Test result---

Test Summary:
CheckPatch                    PASS      1.16 seconds
VerifyFixes                   PASS      0.11 seconds
VerifySignedoff               PASS      0.11 seconds
GitLint                       PASS      0.32 seconds
SubjectPrefix                 PASS      0.10 seconds
BuildKernel                   PASS      29.54 seconds
CheckAllWarning               PASS      33.68 seconds
CheckSparse                   PASS      36.48 seconds
BuildKernel32                 PASS      29.51 seconds
CheckKernelLLVM               PASS      33.97 seconds
TestRunnerSetup               PASS      794.16 seconds
TestRunner_mgmt-tester        PASS      61.30 seconds
TestRunner_mesh-tester        FAIL      7.82 seconds
IncrementalBuild              PASS      39.25 seconds

Details
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Timed out    2.421 seconds
Mesh - Send cancel - 2                               Timed out    1.999 seconds


https://github.com/bluez/bluetooth-next/pull/817

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: MGMT: Fix status of pending commands flushed on power off

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 24 Sep 2026 19:11:58 +0200 you wrote:
> cmd_complete_rsp() receives a struct cmd_lookup and, for a pending
> command that has no cmd_complete callback, falls through to
> cmd_status_rsp(cmd, data). cmd_status_rsp() reads data as a u8 *, so
> the status sent comes from the first byte of match->sk's
> representation, not from match->mgmt_status.
> 
> commit f53e1c9c726d ("Bluetooth: MGMT: Fix possible crash on
> mgmt_index_removed") changed the callers' data from &status to &match
> and updated the cmd_complete branch to match->mgmt_status, but left
> the fall-through passing data unchanged.
> 
> [...]

Here is the summary with links:
  - Bluetooth: MGMT: Fix status of pending commands flushed on power off
    https://git.kernel.org/bluetooth/bluetooth-next/c/86ef0f58bdec

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html