[PATCH BlueZ v1] avrcp: Fix GetTotalNumberOfItems command encoding

[PATCH BlueZ v1] avrcp: Fix GetTotalNumberOfItems command encoding

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

GetTotalNumberOfItems only takes the Scope as parameter, but the command
declared 11 parameter bytes and sent 7, which targets such as iPhones
drop, stalling following browsing requests until BROWSING_TIMEOUT.

Also return FALSE on every response error path since the callback is a
gboolean and negative errno values would keep the request pending.

Closes: https://github.com/bluez/bluez/issues/2745
Fixes: f17d3a2c3b0d ("audio/avrcp: Add support for GetTotalNumberOfItems")
Assisted-by: OpenCode:claude-opus-5.5
---
 profiles/audio/avrcp.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
index df5f97eafc88..c09a32766a31 100644
--- a/profiles/audio/avrcp.c
+++ b/profiles/audio/avrcp.c
@@ -3495,26 +3495,26 @@ static gboolean avrcp_get_total_numberofitems_rsp(struct avctp *conn,
 	uint8_t status;
 
 	if (operands == NULL)
-		return -ETIMEDOUT;
+		return FALSE;
 
 	if (!avrcp_pull_browsing_header(&iov) ||
 			!util_iov_pull_u8(&iov, &status))
-		return -EINVAL;
+		return FALSE;
 
 	if (status == AVRCP_STATUS_OUT_OF_BOUNDS)
 		goto done;
 
 	if (status != AVRCP_STATUS_SUCCESS)
-		return -EINVAL;
+		return FALSE;
 
 	if (!util_iov_pull_be16(&iov, &uid_counter) ||
 			!util_iov_pull_be32(&iov, &num_of_items))
-		return -EINVAL;
+		return FALSE;
 
 	player->uid_counter = uid_counter;
 
 	if (!num_of_items)
-		return -EINVAL;
+		return FALSE;
 
 done:
 	media_player_total_items_complete(mp, num_of_items);
@@ -3523,14 +3523,14 @@ done:
 
 static void avrcp_get_total_numberofitems(struct avrcp *session)
 {
-	uint8_t buf[AVRCP_BROWSING_HEADER_LENGTH + 7];
+	uint8_t buf[AVRCP_BROWSING_HEADER_LENGTH + 1];
 	struct avrcp_player *player = session->controller->player;
 	struct avrcp_browsing_header *pdu = (void *) buf;
 
 	memset(buf, 0, sizeof(buf));
 
 	pdu->pdu_id = AVRCP_GET_TOTAL_NUMBER_OF_ITEMS;
-	pdu->param_len = cpu_to_be16(7 + sizeof(uint32_t));
+	pdu->param_len = cpu_to_be16(1);
 
 	pdu->params[0] = player->scope;
 
-- 
2.56.0

RE: [BlueZ,v1] avrcp: Fix GetTotalNumberOfItems command encoding

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1022 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1203586/

---Test result---

Test Summary:
CheckPatch                    PASS      2.57 seconds
GitLint                       PASS      0.27 seconds
BuildEll                      PASS      21.08 seconds
BluezMake                     PASS      322.34 seconds
MakeCheck                     PASS      7.13 seconds
MakeDistcheck                 PASS      169.94 seconds
CheckValgrind                 PASS      162.45 seconds
CheckSmatch                   PASS      314.22 seconds
bluezmakeextell               PASS      102.01 seconds
TestFunctional                PASS      1219.96 seconds
IncrementalBuild              PASS      350.48 seconds
ScanBuild                     PASS      1227.29 seconds



https://github.com/bluez/bluez/pull/2767

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ v1] avrcp: Fix GetTotalNumberOfItems command encoding

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu,  5 Nov 2026 17:16:20 -0500 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> GetTotalNumberOfItems only takes the Scope as parameter, but the command
> declared 11 parameter bytes and sent 7, which targets such as iPhones
> drop, stalling following browsing requests until BROWSING_TIMEOUT.
> 
> Also return FALSE on every response error path since the callback is a
> gboolean and negative errno values would keep the request pending.
> 
> [...]

Here is the summary with links:
  - [BlueZ,v1] avrcp: Fix GetTotalNumberOfItems command encoding
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=a8067198717b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html