[PATCH] Bluetooth: Reject controller operations while powering down

[zhangchen200426@163.com]

From: Chen Zhang <zhangchen01@kylinos.cn>

When an adapter is powered off with devices still connected (e.g. a
Bluetooth keyboard or mouse), the shutdown sequence issues an HCI reset
which returns Command Complete while the controller firmware is still
rebooting. A concurrent command sent through a raw socket during this
window (e.g. periodic hciconfig queries triggered by the Bluetooth
status change) can leave the firmware in a stuck state where it stops
answering any HCI command. The subsequent power on then fails with
'Bluetooth: hci0: Opcode 0x0c03 failed: -110' and the adapter is lost
until reboot or re-enumeration.

Reject controller operations while HCI_POWERING_DOWN is set at the
public entry points in hci_core.c, which covers the ioctl (HCIDEVUP,
HCIDEVDOWN, HCIDEVRESET) and raw socket bind paths:
- hci_dev_open(): return -EBUSY
- hci_dev_close(): return -EBUSY
- hci_dev_reset(): return -EBUSY

In addition reject raw command transmission from an already bound
socket during the power down sequence in hci_sock_sendmsg()
(-ENETDOWN), and fail early in hci_sock_bind() (-EBUSY) to avoid
toggling HCI_USER_CHANNEL while powering down.

Signed-off-by: Chen Zhang <zhangchen01@kylinos.cn>
---
 net/bluetooth/hci_core.c | 28 ++++++++++++++++++++++++++++
 net/bluetooth/hci_sock.c |  4 +++-
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d1e78ae7728e..a0533f260471 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -445,6 +445,16 @@ int hci_dev_open(__u16 dev)
 	if (!hdev)
 		return -ENODEV;
 
+	/* Reject opening the controller while it is being powered down:
+	 * the firmware is rebooting after the shutdown reset and any
+	 * concurrent command sent during this window can leave it in a
+	 * stuck state where it stops answering HCI commands.
+	 */
+	if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) {
+		err = -EBUSY;
+		goto done;
+	}
+
 	/* Devices that are marked as unconfigured can only be powered
 	 * up as user channel. Trying to bring them up as normal devices
 	 * will result into a failure. Only user channel operation is
@@ -515,6 +525,14 @@ int hci_dev_close(__u16 dev)
 	if (!hdev)
 		return -ENODEV;
 
+	/* Reject closing the controller while the power off sequence
+	 * is already in progress (see hci_dev_open for details).
+	 */
+	if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) {
+		err = -EBUSY;
+		goto done;
+	}
+
 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
 		err = -EBUSY;
 		goto done;
@@ -556,6 +574,16 @@ int hci_dev_reset(__u16 dev)
 	if (!hdev)
 		return -ENODEV;
 
+	/* Reject resetting the controller while the power off sequence
+	 * is in progress: the shutdown routine already issues its own
+	 * HCI reset and a concurrent one would hit the firmware while
+	 * it is rebooting (see hci_dev_open for details).
+	 */
+	if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) {
+		err = -EBUSY;
+		goto done;
+	}
+
 	if (!test_bit(HCI_UP, &hdev->flags)) {
 		err = -ENETDOWN;
 		goto done;
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 070ca388f9ac..897596614939 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1296,6 +1296,7 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr_unsized *addr,
 		if (test_bit(HCI_INIT, &hdev->flags) ||
 		    hci_dev_test_flag(hdev, HCI_SETUP) ||
 		    hci_dev_test_flag(hdev, HCI_CONFIG) ||
+		    hci_dev_test_flag(hdev, HCI_POWERING_DOWN) ||
 		    (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) &&
 		     test_bit(HCI_UP, &hdev->flags))) {
 			err = -EBUSY;
@@ -1850,7 +1851,8 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 		goto drop;
 	}
 
-	if (!test_bit(HCI_UP, &hdev->flags)) {
+	if (!test_bit(HCI_UP, &hdev->flags) ||
+	    hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) {
 		err = -ENETDOWN;
 		goto drop;
 	}
-- 
2.25.1