[PATCH 1/3] Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists

[PATCH 1/3] Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists

[Pauli Virtanen]

hci_cmd_sync_queue_once() needs to indicate whether a queue item was
added, so caller can know if callbacks are called, so it can avoid
leaking resources.

Change the function to return -EEXIST if queue item already exists.

Modify all callsites to handle that.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
 net/bluetooth/hci_sync.c | 53 +++++++++++++++++++++++++++-------------
 1 file changed, 36 insertions(+), 17 deletions(-)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 45d16639874a..4e2c8a759e63 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -780,7 +780,7 @@ int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
 			    void *data, hci_cmd_sync_work_destroy_t destroy)
 {
 	if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy))
-		return 0;
+		return -EEXIST;
 
 	return hci_cmd_sync_queue(hdev, func, data, destroy);
 }
@@ -3255,6 +3255,8 @@ static int update_passive_scan_sync(struct hci_dev *hdev, void *data)
 
 int hci_update_passive_scan(struct hci_dev *hdev)
 {
+	int err;
+
 	/* Only queue if it would have any effect */
 	if (!test_bit(HCI_UP, &hdev->flags) ||
 	    test_bit(HCI_INIT, &hdev->flags) ||
@@ -3264,8 +3266,9 @@ int hci_update_passive_scan(struct hci_dev *hdev)
 	    hci_dev_test_flag(hdev, HCI_UNREGISTER))
 		return 0;
 
-	return hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL,
-				       NULL);
+	err = hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL,
+				      NULL);
+	return (err == -EEXIST) ? 0 : err;
 }
 
 int hci_write_sc_support_sync(struct hci_dev *hdev, u8 val)
@@ -6958,8 +6961,11 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data)
 
 int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn)
 {
-	return hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn,
-				       NULL);
+	int err;
+
+	err = hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn,
+				      NULL);
+	return (err == -EEXIST) ? 0 : err;
 }
 
 static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)
@@ -6995,8 +7001,11 @@ static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)
 
 int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn)
 {
-	return hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn,
-				       create_le_conn_complete);
+	int err;
+
+	err = hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn,
+				      create_le_conn_complete);
+	return (err == -EEXIST) ? 0 : err;
 }
 
 int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn)
@@ -7203,8 +7212,11 @@ static int hci_le_pa_create_sync(struct hci_dev *hdev, void *data)
 
 int hci_connect_pa_sync(struct hci_dev *hdev, struct hci_conn *conn)
 {
-	return hci_cmd_sync_queue_once(hdev, hci_le_pa_create_sync, conn,
-				       create_pa_complete);
+	int err;
+
+	err = hci_cmd_sync_queue_once(hdev, hci_le_pa_create_sync, conn,
+				      create_pa_complete);
+	return (err == -EEXIST) ? 0 : err;
 }
 
 static void create_big_complete(struct hci_dev *hdev, void *data, int err)
@@ -7266,8 +7278,11 @@ static int hci_le_big_create_sync(struct hci_dev *hdev, void *data)
 
 int hci_connect_big_sync(struct hci_dev *hdev, struct hci_conn *conn)
 {
-	return hci_cmd_sync_queue_once(hdev, hci_le_big_create_sync, conn,
-				       create_big_complete);
+	int err;
+
+	err = hci_cmd_sync_queue_once(hdev, hci_le_big_create_sync, conn,
+				      create_big_complete);
+	return (err == -EEXIST) ? 0 : err;
 }
 
 struct past_data {
@@ -7359,7 +7374,7 @@ int hci_past_sync(struct hci_conn *conn, struct hci_conn *le)
 	if (err)
 		kfree(data);
 
-	return err;
+	return (err == -EEXIST) ? 0 : err;
 }
 
 static void le_read_features_complete(struct hci_dev *hdev, void *data, int err)
@@ -7446,7 +7461,7 @@ int hci_le_read_remote_features(struct hci_conn *conn)
 	else
 		err = -EOPNOTSUPP;
 
-	return err;
+	return (err == -EEXIST) ? 0 : err;
 }
 
 static void pkt_type_changed(struct hci_dev *hdev, void *data, int err)
@@ -7472,6 +7487,7 @@ int hci_acl_change_pkt_type(struct hci_conn *conn, u16 pkt_type)
 {
 	struct hci_dev *hdev = conn->hdev;
 	struct hci_cp_change_conn_ptype *cp;
+	int err;
 
 	cp = kmalloc_obj(*cp);
 	if (!cp)
@@ -7480,8 +7496,9 @@ int hci_acl_change_pkt_type(struct hci_conn *conn, u16 pkt_type)
 	cp->handle = cpu_to_le16(conn->handle);
 	cp->pkt_type = cpu_to_le16(pkt_type);
 
-	return hci_cmd_sync_queue_once(hdev, hci_change_conn_ptype_sync, cp,
-				       pkt_type_changed);
+	err = hci_cmd_sync_queue_once(hdev, hci_change_conn_ptype_sync, cp,
+				      pkt_type_changed);
+	return (err == -EEXIST) ? 0 : err;
 }
 
 static void le_phy_update_complete(struct hci_dev *hdev, void *data, int err)
@@ -7507,6 +7524,7 @@ int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys)
 {
 	struct hci_dev *hdev = conn->hdev;
 	struct hci_cp_le_set_phy *cp;
+	int err;
 
 	cp = kmalloc_obj(*cp);
 	if (!cp)
@@ -7517,6 +7535,7 @@ int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys)
 	cp->tx_phys = tx_phys;
 	cp->rx_phys = rx_phys;
 
-	return hci_cmd_sync_queue_once(hdev, hci_le_set_phy_sync, cp,
-				       le_phy_update_complete);
+	err = hci_cmd_sync_queue_once(hdev, hci_le_set_phy_sync, cp,
+				      le_phy_update_complete);
+	return (err == -EEXIST) ? 0 : err;
 }
-- 
2.53.0

[PATCH 2/3] Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails

[Pauli Virtanen]

When hci_cmd_sync_queue_once() returns with error, the destroy callback
will not be called.

Fix leaking references / memory on these failures.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
 net/bluetooth/hci_sync.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 4e2c8a759e63..0b28495197c2 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -7453,13 +7453,16 @@ int hci_le_read_remote_features(struct hci_conn *conn)
 	 * role is possible. Otherwise just transition into the
 	 * connected state without requesting the remote features.
 	 */
-	if (conn->out || (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
+	if (conn->out || (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
 		err = hci_cmd_sync_queue_once(hdev,
 					      hci_le_read_remote_features_sync,
 					      hci_conn_hold(conn),
 					      le_read_features_complete);
-	else
+		if (err)
+			hci_conn_drop(conn);
+	} else {
 		err = -EOPNOTSUPP;
+	}
 
 	return (err == -EEXIST) ? 0 : err;
 }
@@ -7498,6 +7501,9 @@ int hci_acl_change_pkt_type(struct hci_conn *conn, u16 pkt_type)
 
 	err = hci_cmd_sync_queue_once(hdev, hci_change_conn_ptype_sync, cp,
 				      pkt_type_changed);
+	if (err)
+		kfree(cp);
+
 	return (err == -EEXIST) ? 0 : err;
 }
 
@@ -7537,5 +7543,8 @@ int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys)
 
 	err = hci_cmd_sync_queue_once(hdev, hci_le_set_phy_sync, cp,
 				      le_phy_update_complete);
+	if (err)
+		kfree(cp);
+
 	return (err == -EEXIST) ? 0 : err;
 }
-- 
2.53.0

[PATCH 3/3] Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists

[Pauli Virtanen]

hci_cmd_sync_run_once() needs to indicate whether a queue item was
added, so caller can know if callbacks are called, so it can avoid
leaking resources.

Change the function to return -EEXIST if queue item already exists.

hci_cmd_sync_run() may run the work immediately. If so, make it behave
as if item was queued successfully. Change it to call also destroy() and
return 0.

Modify all callsites vs. the changes.

The only callsite is hci_abort_conn(), and this changes its return
value. However, its return value is not used except as the return value
for hci_disconnect(), and nothing uses the return value of
hci_disconnect(). Hence there should be no behavior change anywhere.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
 net/bluetooth/hci_conn.c |  4 +++-
 net/bluetooth/hci_sync.c | 13 ++++++++++---
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index e6393f17576b..8cc2cc58c3f8 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -3077,6 +3077,7 @@ static int abort_conn_sync(struct hci_dev *hdev, void *data)
 int hci_abort_conn(struct hci_conn *conn, u8 reason)
 {
 	struct hci_dev *hdev = conn->hdev;
+	int err;
 
 	/* If abort_reason has already been set it means the connection is
 	 * already being aborted so don't attempt to overwrite it.
@@ -3113,7 +3114,8 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason)
 	 * as a result to MGMT_OP_DISCONNECT/MGMT_OP_UNPAIR which does
 	 * already queue its callback on cmd_sync_work.
 	 */
-	return hci_cmd_sync_run_once(hdev, abort_conn_sync, conn, NULL);
+	err = hci_cmd_sync_run_once(hdev, abort_conn_sync, conn, NULL);
+	return (err == -EEXIST) ? 0 : err;
 }
 
 void hci_setup_tx_timestamp(struct sk_buff *skb, size_t key_offset,
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 0b28495197c2..47d902310b19 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -801,8 +801,15 @@ int hci_cmd_sync_run(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
 		return -ENETDOWN;
 
 	/* If on cmd_sync_work then run immediately otherwise queue */
-	if (current_work() == &hdev->cmd_sync_work)
-		return func(hdev, data);
+	if (current_work() == &hdev->cmd_sync_work) {
+		int err;
+
+		err = func(hdev, data);
+		if (destroy)
+			destroy(hdev, data, err);
+
+		return 0;
+	}
 
 	return hci_cmd_sync_submit(hdev, func, data, destroy);
 }
@@ -818,7 +825,7 @@ int hci_cmd_sync_run_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
 			  void *data, hci_cmd_sync_work_destroy_t destroy)
 {
 	if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy))
-		return 0;
+		return -EEXIST;
 
 	return hci_cmd_sync_run(hdev, func, data, destroy);
 }
-- 
2.53.0

RE: [1/3] Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3101 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1072457

---Test result---

Test Summary:
CheckPatch                    PENDING   0.32 seconds
GitLint                       PENDING   0.23 seconds
SubjectPrefix                 PASS      0.36 seconds
BuildKernel                   PASS      26.82 seconds
CheckAllWarning               PASS      29.66 seconds
CheckSparse                   PASS      28.46 seconds
BuildKernel32                 PASS      25.85 seconds
TestRunnerSetup               PASS      574.10 seconds
TestRunner_l2cap-tester       FAIL      28.23 seconds
TestRunner_iso-tester         FAIL      36.55 seconds
TestRunner_bnep-tester        PASS      6.35 seconds
TestRunner_mgmt-tester        FAIL      116.86 seconds
TestRunner_rfcomm-tester      PASS      9.44 seconds
TestRunner_sco-tester         FAIL      14.48 seconds
TestRunner_ioctl-tester       PASS      10.38 seconds
TestRunner_mesh-tester        FAIL      11.48 seconds
TestRunner_smp-tester         PASS      8.62 seconds
TestRunner_userchan-tester    PASS      6.72 seconds
IncrementalBuild              PENDING   0.90 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: TestRunner_l2cap-tester - FAIL
Desc: Run l2cap-tester with test-runner
Output:
Total: 96, Passed: 95 (99.0%), Failed: 1, Not Run: 0

Failed Test Cases
L2CAP BR/EDR Server - Set PHY 2M                     Failed       0.116 seconds
##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
BUG: KASAN: slab-use-after-free in le_read_features_complete+0x7e/0x2b0
Total: 141, Passed: 141 (100.0%), Failed: 0, Not Run: 0
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 494, Passed: 489 (99.0%), Failed: 1, Not Run: 4

Failed Test Cases
Read Exp Feature - Success                           Failed       0.105 seconds
##############################
Test: TestRunner_sco-tester - FAIL
Desc: Run sco-tester with test-runner
Output:
WARNING: possible circular locking dependency detected
BUG: sleeping function called from invalid context at net/core/sock.c:3782
Total: 30, Passed: 30 (100.0%), Failed: 0, Not Run: 0
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Timed out    1.821 seconds
Mesh - Send cancel - 2                               Timed out    1.994 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth

Re: [PATCH 3/3] Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists

[Luiz Augusto von Dentz]

Hi Pauli,

On Wed, Mar 25, 2026 at 1:42 PM Pauli Virtanen <pav@iki.fi> wrote:
>
> hci_cmd_sync_run_once() needs to indicate whether a queue item was
> added, so caller can know if callbacks are called, so it can avoid
> leaking resources.
>
> Change the function to return -EEXIST if queue item already exists.
>
> hci_cmd_sync_run() may run the work immediately. If so, make it behave
> as if item was queued successfully. Change it to call also destroy() and
> return 0.
>
> Modify all callsites vs. the changes.
>
> The only callsite is hci_abort_conn(), and this changes its return
> value. However, its return value is not used except as the return value
> for hci_disconnect(), and nothing uses the return value of
> hci_disconnect(). Hence there should be no behavior change anywhere.
>
> Signed-off-by: Pauli Virtanen <pav@iki.fi>
> ---
>  net/bluetooth/hci_conn.c |  4 +++-
>  net/bluetooth/hci_sync.c | 13 ++++++++++---
>  2 files changed, 13 insertions(+), 4 deletions(-)
>
> diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
> index e6393f17576b..8cc2cc58c3f8 100644
> --- a/net/bluetooth/hci_conn.c
> +++ b/net/bluetooth/hci_conn.c
> @@ -3077,6 +3077,7 @@ static int abort_conn_sync(struct hci_dev *hdev, void *data)
>  int hci_abort_conn(struct hci_conn *conn, u8 reason)
>  {
>         struct hci_dev *hdev = conn->hdev;
> +       int err;
>
>         /* If abort_reason has already been set it means the connection is
>          * already being aborted so don't attempt to overwrite it.
> @@ -3113,7 +3114,8 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason)
>          * as a result to MGMT_OP_DISCONNECT/MGMT_OP_UNPAIR which does
>          * already queue its callback on cmd_sync_work.
>          */
> -       return hci_cmd_sync_run_once(hdev, abort_conn_sync, conn, NULL);
> +       err = hci_cmd_sync_run_once(hdev, abort_conn_sync, conn, NULL);
> +       return (err == -EEXIST) ? 0 : err;
>  }
>
>  void hci_setup_tx_timestamp(struct sk_buff *skb, size_t key_offset,
> diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
> index 0b28495197c2..47d902310b19 100644
> --- a/net/bluetooth/hci_sync.c
> +++ b/net/bluetooth/hci_sync.c
> @@ -801,8 +801,15 @@ int hci_cmd_sync_run(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
>                 return -ENETDOWN;
>
>         /* If on cmd_sync_work then run immediately otherwise queue */
> -       if (current_work() == &hdev->cmd_sync_work)
> -               return func(hdev, data);
> +       if (current_work() == &hdev->cmd_sync_work) {
> +               int err;
> +
> +               err = func(hdev, data);
> +               if (destroy)
> +                       destroy(hdev, data, err);

It is probably worth splitting this change into its own commit so we
can add a Fixes: tag and backport it.

> +               return 0;
> +       }
>
>         return hci_cmd_sync_submit(hdev, func, data, destroy);
>  }
> @@ -818,7 +825,7 @@ int hci_cmd_sync_run_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
>                           void *data, hci_cmd_sync_work_destroy_t destroy)
>  {
>         if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy))
> -               return 0;
> +               return -EEXIST;
>
>         return hci_cmd_sync_run(hdev, func, data, destroy);
>  }
> --
> 2.53.0
>
>


-- 
Luiz Augusto von Dentz

Re: [PATCH 3/3] Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists

[Pauli Virtanen]

Hi,

ke, 2026-03-25 kello 14:43 -0400, Luiz Augusto von Dentz kirjoitti:
> Hi Pauli,
> 
> On Wed, Mar 25, 2026 at 1:42 PM Pauli Virtanen <pav@iki.fi> wrote:
> > 
> > hci_cmd_sync_run_once() needs to indicate whether a queue item was
> > added, so caller can know if callbacks are called, so it can avoid
> > leaking resources.
> > 
> > Change the function to return -EEXIST if queue item already exists.
> > 
> > hci_cmd_sync_run() may run the work immediately. If so, make it behave
> > as if item was queued successfully. Change it to call also destroy() and
> > return 0.
> > 
> > Modify all callsites vs. the changes.
> > 
> > The only callsite is hci_abort_conn(), and this changes its return
> > value. However, its return value is not used except as the return value
> > for hci_disconnect(), and nothing uses the return value of
> > hci_disconnect(). Hence there should be no behavior change anywhere.
> > 
> > Signed-off-by: Pauli Virtanen <pav@iki.fi>
> > ---
> >  net/bluetooth/hci_conn.c |  4 +++-
> >  net/bluetooth/hci_sync.c | 13 ++++++++++---
> >  2 files changed, 13 insertions(+), 4 deletions(-)
> > 
> > diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
> > index e6393f17576b..8cc2cc58c3f8 100644
> > --- a/net/bluetooth/hci_conn.c
> > +++ b/net/bluetooth/hci_conn.c
> > @@ -3077,6 +3077,7 @@ static int abort_conn_sync(struct hci_dev *hdev, void *data)
> >  int hci_abort_conn(struct hci_conn *conn, u8 reason)
> >  {
> >         struct hci_dev *hdev = conn->hdev;
> > +       int err;
> > 
> >         /* If abort_reason has already been set it means the connection is
> >          * already being aborted so don't attempt to overwrite it.
> > @@ -3113,7 +3114,8 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason)
> >          * as a result to MGMT_OP_DISCONNECT/MGMT_OP_UNPAIR which does
> >          * already queue its callback on cmd_sync_work.
> >          */
> > -       return hci_cmd_sync_run_once(hdev, abort_conn_sync, conn, NULL);
> > +       err = hci_cmd_sync_run_once(hdev, abort_conn_sync, conn, NULL);
> > +       return (err == -EEXIST) ? 0 : err;
> >  }
> > 
> >  void hci_setup_tx_timestamp(struct sk_buff *skb, size_t key_offset,
> > diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
> > index 0b28495197c2..47d902310b19 100644
> > --- a/net/bluetooth/hci_sync.c
> > +++ b/net/bluetooth/hci_sync.c
> > @@ -801,8 +801,15 @@ int hci_cmd_sync_run(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
> >                 return -ENETDOWN;
> > 
> >         /* If on cmd_sync_work then run immediately otherwise queue */
> > -       if (current_work() == &hdev->cmd_sync_work)
> > -               return func(hdev, data);
> > +       if (current_work() == &hdev->cmd_sync_work) {
> > +               int err;
> > +
> > +               err = func(hdev, data);
> > +               if (destroy)
> > +                       destroy(hdev, data, err);
> 
> It is probably worth splitting this change into its own commit so we
> can add a Fixes: tag and backport it.

Ok.

Btw, sashiko produced valid comments on pre-existing usage of
queue_once, maybe some of these should be hci_cmd_sync_queue or
queue_once needs custom comparison API

https://sashiko.dev/#/patchset/f7ccb4a4f9e462a6c1c1ddba8dd1cdcc9456944b.1774459946.git.pav%40iki.fi

> 
> > +               return 0;
> > +       }
> > 
> >         return hci_cmd_sync_submit(hdev, func, data, destroy);
> >  }
> > @@ -818,7 +825,7 @@ int hci_cmd_sync_run_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
> >                           void *data, hci_cmd_sync_work_destroy_t destroy)
> >  {
> >         if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy))
> > -               return 0;
> > +               return -EEXIST;
> > 
> >         return hci_cmd_sync_run(hdev, func, data, destroy);
> >  }
> > --
> > 2.53.0
> > 
> > 
> 

-- 
Pauli Virtanen

Re: [PATCH 3/3] Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists

[Luiz Augusto von Dentz]

Hi Pauli,

On Wed, Mar 25, 2026 at 3:15 PM Pauli Virtanen <pauli.virtanen@iki.fi> wrote:
>
> Hi,
>
> ke, 2026-03-25 kello 14:43 -0400, Luiz Augusto von Dentz kirjoitti:
> > Hi Pauli,
> >
> > On Wed, Mar 25, 2026 at 1:42 PM Pauli Virtanen <pav@iki.fi> wrote:
> > >
> > > hci_cmd_sync_run_once() needs to indicate whether a queue item was
> > > added, so caller can know if callbacks are called, so it can avoid
> > > leaking resources.
> > >
> > > Change the function to return -EEXIST if queue item already exists.
> > >
> > > hci_cmd_sync_run() may run the work immediately. If so, make it behave
> > > as if item was queued successfully. Change it to call also destroy() and
> > > return 0.
> > >
> > > Modify all callsites vs. the changes.
> > >
> > > The only callsite is hci_abort_conn(), and this changes its return
> > > value. However, its return value is not used except as the return value
> > > for hci_disconnect(), and nothing uses the return value of
> > > hci_disconnect(). Hence there should be no behavior change anywhere.
> > >
> > > Signed-off-by: Pauli Virtanen <pav@iki.fi>
> > > ---
> > >  net/bluetooth/hci_conn.c |  4 +++-
> > >  net/bluetooth/hci_sync.c | 13 ++++++++++---
> > >  2 files changed, 13 insertions(+), 4 deletions(-)
> > >
> > > diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
> > > index e6393f17576b..8cc2cc58c3f8 100644
> > > --- a/net/bluetooth/hci_conn.c
> > > +++ b/net/bluetooth/hci_conn.c
> > > @@ -3077,6 +3077,7 @@ static int abort_conn_sync(struct hci_dev *hdev, void *data)
> > >  int hci_abort_conn(struct hci_conn *conn, u8 reason)
> > >  {
> > >         struct hci_dev *hdev = conn->hdev;
> > > +       int err;
> > >
> > >         /* If abort_reason has already been set it means the connection is
> > >          * already being aborted so don't attempt to overwrite it.
> > > @@ -3113,7 +3114,8 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason)
> > >          * as a result to MGMT_OP_DISCONNECT/MGMT_OP_UNPAIR which does
> > >          * already queue its callback on cmd_sync_work.
> > >          */
> > > -       return hci_cmd_sync_run_once(hdev, abort_conn_sync, conn, NULL);
> > > +       err = hci_cmd_sync_run_once(hdev, abort_conn_sync, conn, NULL);
> > > +       return (err == -EEXIST) ? 0 : err;
> > >  }
> > >
> > >  void hci_setup_tx_timestamp(struct sk_buff *skb, size_t key_offset,
> > > diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
> > > index 0b28495197c2..47d902310b19 100644
> > > --- a/net/bluetooth/hci_sync.c
> > > +++ b/net/bluetooth/hci_sync.c
> > > @@ -801,8 +801,15 @@ int hci_cmd_sync_run(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
> > >                 return -ENETDOWN;
> > >
> > >         /* If on cmd_sync_work then run immediately otherwise queue */
> > > -       if (current_work() == &hdev->cmd_sync_work)
> > > -               return func(hdev, data);
> > > +       if (current_work() == &hdev->cmd_sync_work) {
> > > +               int err;
> > > +
> > > +               err = func(hdev, data);
> > > +               if (destroy)
> > > +                       destroy(hdev, data, err);
> >
> > It is probably worth splitting this change into its own commit so we
> > can add a Fixes: tag and backport it.
>
> Ok.
>
> Btw, sashiko produced valid comments on pre-existing usage of
> queue_once, maybe some of these should be hci_cmd_sync_queue or
> queue_once needs custom comparison API
>
> https://sashiko.dev/#/patchset/f7ccb4a4f9e462a6c1c1ddba8dd1cdcc9456944b.1774459946.git.pav%40iki.fi

Yeah, the data might be useless to compare most of the time, well
except if it is something like hci_conn for example.

> >
> > > +               return 0;
> > > +       }
> > >
> > >         return hci_cmd_sync_submit(hdev, func, data, destroy);
> > >  }
> > > @@ -818,7 +825,7 @@ int hci_cmd_sync_run_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
> > >                           void *data, hci_cmd_sync_work_destroy_t destroy)
> > >  {
> > >         if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy))
> > > -               return 0;
> > > +               return -EEXIST;
> > >
> > >         return hci_cmd_sync_run(hdev, func, data, destroy);
> > >  }
> > > --
> > > 2.53.0
> > >
> > >
> >
>
> --
> Pauli Virtanen



-- 
Luiz Augusto von Dentz