[PATCH v1] Bluetooth: Fix not updating of hdev->commands[] after reset

[PATCH v1] Bluetooth: Fix not updating of hdev->commands[] after reset

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Read Local Supported Commands was only read once during the INIT/SETUP
flow, but the supported commands bits may change at runtime, for
example after a firmware change applied with vendor commands, so update
hdev->commands[] every time the response is received.

Fixes: 6a070e6e81ad ("Bluetooth: Store supported commands only during setup procedure")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 net/bluetooth/hci_event.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index a52574003e4f..5e6b25eb5053 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -816,9 +816,7 @@ static u8 hci_cc_read_local_commands(struct hci_dev *hdev, void *data,
 	if (rp->status)
 		return rp->status;
 
-	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
-	    hci_dev_test_flag(hdev, HCI_CONFIG))
-		memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
+	memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 
 	return rp->status;
 }
-- 
2.56.0

RE: [v1] Bluetooth: Fix not updating of hdev->commands[] after reset

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3452 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1202519/

---Test result---

Test Summary:
CheckPatch                    PASS      0.59 seconds
VerifyFixes                   PASS      0.07 seconds
VerifySignedoff               PASS      0.07 seconds
GitLint                       PASS      0.22 seconds
SubjectPrefix                 PASS      0.07 seconds
BuildKernel                   PASS      31.38 seconds
CheckAllWarning               PASS      35.58 seconds
CheckSparse                   WARNING   38.36 seconds
BuildKernel32                 PASS      30.73 seconds
CheckKernelLLVM               PASS      33.06 seconds
TestRunnerSetup               PASS      742.14 seconds
TestRunner_l2cap-tester       FAIL      10.67 seconds
TestRunner_iso-tester         PASS      21.63 seconds
TestRunner_bnep-tester        PASS      9.66 seconds
TestRunner_mgmt-tester        PASS      88.22 seconds
TestRunner_rfcomm-tester      PASS      4.47 seconds
TestRunner_sco-tester         PASS      5.63 seconds
TestRunner_ioctl-tester       PASS      4.65 seconds
TestRunner_mesh-tester        PASS      5.53 seconds
TestRunner_smp-tester         PASS      4.36 seconds
TestRunner_userchan-tester    PASS      3.21 seconds
TestRunner_6lowpan-tester     PASS      4.42 seconds
IncrementalBuild              PASS      29.12 seconds

Details
##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):
##############################
Test: TestRunner_l2cap-tester - FAIL
Desc: Run l2cap-tester with test-runner
Output:
Sanitizer errors:
==35==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b69e63e33d0 at pc 0x564e45f78eee bp 0x7ffd6db81ef0 sp 0x7ffd6db81ee0
READ of size 4 at 0x7b69e63e33d0 thread T0
    #0 0x564e45f78eed in timeout_callback src/shared/timeout-mainloop.c:33
    #1 0x564e45f79ed5 in timeout_callback src/shared/mainloop.c:271
    #2 0x564e45f7b006 in mainloop_run src/shared/mainloop.c:125
    #3 0x564e45f7d96a in mainloop_run_with_signal src/shared/mainloop-notify.c:196
    #4 0x564e45f82c4b in tester_run src/shared/tester.c:1297
    #5 0x564e45eac1dd in main tools/l2cap-tester.c:3918
    #6 0x7f29e7387600 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:59
    #7 0x7f29e7387717 in __libc_start_main_impl ../csu/libc-start.c:360
    #8 0x564e45eb2ce4 in _start (/home/runner/work/bluetooth-next/bluetooth-next/src/bluez/tools/l2cap-tester+0x16dce4) (BuildId: 4b6cbb2e2c80ac13520eedc70b7cea5c676c63f3)

0x7b69e63e33d0 is located 0 bytes inside of 40-byte region [0x7b69e63e33d0,0x7b69e63e33f8)
freed by thread T0 here:
    #0 0x7f29e7cc53ff in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:51
    #1 0x564e45f793ca in timeout_destroy src/shared/mainloop.c:252

previously allocated by thread T0 here:
    #0 0x7f29e7cc660f in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67
    #1 0x564e45f63335 in util_malloc src/shared/util.c:46

SUMMARY: AddressSanitizer: heap-use-after-free src/shared/timeout-mainloop.c:33 in timeout_callback
No test result found


https://github.com/bluez/bluetooth-next/pull/1068

---
Regards,
Linux Bluetooth

Re: [PATCH v1] Bluetooth: Fix not updating of hdev->commands[] after reset

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed,  4 Nov 2026 17:19:56 -0500 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> Read Local Supported Commands was only read once during the INIT/SETUP
> flow, but the supported commands bits may change at runtime, for
> example after a firmware change applied with vendor commands, so update
> hdev->commands[] every time the response is received.
> 
> [...]

Here is the summary with links:
  - [v1] Bluetooth: Fix not updating of hdev->commands[] after reset
    https://git.kernel.org/bluetooth/bluetooth-next/c/e00aa1a33f81

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html