Re: [PATCH v2] Bluetooth: mgmt: reply to cancelled mgmt commands instead of silently dropping

[Shuai Zhang <shuai.zhang@oss.qualcomm.com>]

Hi Luiz

On 8/18/2026 2:05 AM, Luiz Augusto von Dentz wrote:
> Hi Shuai,
>
> On Mon, Aug 17, 2026 at 2:01 AM Shuai Zhang
> <shuai.zhang@oss.qualcomm.com> wrote:
>> The kernel sets HCI_AUTO_OFF when a controller is first registered and
>> starts a 2-second timer. On slower boots bluetoothd and the HCI_AUTO_OFF
>> timer can race: hci_power_off() is already queued while bluetoothd is
>> still in the middle of its adapter setup sequence. hci_cmd_sync_clear()
>> then cancels any pending mgmt commands with -ECANCELED, including the
>> MGMT_OP_REMOVE_ADV_MONITOR sent by reset_adv_monitors() early in the
>> setup sequence.
>>
>> When auto_off=1, hci_dev_close_sync() skips __mgmt_power_off() entirely,
>> so there is no fallback path to reply to the cancelled commands.
>> mgmt_remove_adv_monitor_complete() silently returns on -ECANCELED, leaving
>> the command with no reply. Since bluez's mgmt queue is strictly serialised,
>> this stalls all subsequent commands indefinitely, leaving bluetoothd unable
>> to register the adapter.
>>
>> Fix by mapping -ECANCELED to MGMT_STATUS_CANCELLED in mgmt_errno_status()
>> and removing the early return in mgmt_remove_adv_monitor_complete(), so
>> bluetoothd receives a reply and can continue normally.
>>
>> Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
>> ---
>>   net/bluetooth/mgmt.c | 5 ++---
>>   1 file changed, 2 insertions(+), 3 deletions(-)
>>
>> diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
>> index ac4864e56..c660bd3cd 100644
>> --- a/net/bluetooth/mgmt.c
>> +++ b/net/bluetooth/mgmt.c
>> @@ -301,6 +301,8 @@ static u8 mgmt_errno_status(int err)
>>                  return MGMT_STATUS_ALREADY_CONNECTED;
>>          case -ENOTCONN:
>>                  return MGMT_STATUS_DISCONNECTED;
>> +       case -ECANCELED:
>> +               return MGMT_STATUS_CANCELLED;
>>          }
>>
>>          return MGMT_STATUS_FAILED;
>> @@ -5675,9 +5677,6 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
>>          struct mgmt_pending_cmd *cmd = data;
>>          struct mgmt_cp_remove_adv_monitor *cp;
>>
>> -       if (status == -ECANCELED)
>> -               return;
>> -
>>          hci_dev_lock(hdev);
>>
>>          cp = cmd->param;
>> --
>> 2.34.1
>>
> Sashiko is flagging a couple of problems:
>
> https://sashiko.dev/#/patchset/20260817060134.3298439-1-shuai.zhang%40oss.qualcomm.com
This is indeed a valid issue. I'll address it in the next revision.

Thanks

shuai


>