Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync

commit 1c3366abdbe884be62e5a7502b4db758aa3974c6 upstream.

hci_cmd_sync_cancel_sync shall check the error passed to it since it
will be propagated using req_result which is __u32 it needs to be
properly set to a positive value if it was passed as negative othertise
IS_ERR will not trigger as -(errno) would be converted to a positive
value.

Fixes: 63298d6e752f ("Bluetooth: hci_core: Cancel request on command timeout")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Reported-and-tested-by: Thorsten Leemhuis <linux@leemhuis.info>
Closes: https://lore.kernel.org/all/08275279-7462-4f4a-a0ee-8aa015f829bc@leemhuis.info/
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 70f24dc75b5964fe1153f729c6752e38d5732641..02e67ff05b7b450a12aa8f91d5b1207595059d58 100644 (file)
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2838,7 +2838,7 @@ static void hci_cancel_cmd_sync(struct hci_dev *hdev, int err)
        cancel_delayed_work_sync(&hdev->ncmd_timer);
        atomic_set(&hdev->cmd_cnt, 1);
 
-       hci_cmd_sync_cancel_sync(hdev, -err);
+       hci_cmd_sync_cancel_sync(hdev, err);
 }
 
 /* Suspend HCI device */
@@ -2858,7 +2858,7 @@ int hci_suspend_dev(struct hci_dev *hdev)
                return 0;
 
        /* Cancel potentially blocking sync operation before suspend */
-       hci_cancel_cmd_sync(hdev, -EHOSTDOWN);
+       hci_cancel_cmd_sync(hdev, EHOSTDOWN);
 
        hci_req_sync_lock(hdev);
        ret = hci_suspend_sync(hdev);
@@ -4169,7 +4169,7 @@ static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)
 
        err = hci_send_frame(hdev, skb);
        if (err < 0) {
-               hci_cmd_sync_cancel_sync(hdev, err);
+               hci_cmd_sync_cancel_sync(hdev, -err);
                return;
        }
 

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 65b2ad34179f8781df4e18a951ace1adc2064a6f..7e64cf880f9f1d40599b95d13b3f33ffb77b6f71 100644 (file)
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -678,7 +678,10 @@ void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err)
        bt_dev_dbg(hdev, "err 0x%2.2x", err);
 
        if (hdev->req_status == HCI_REQ_PEND) {
-               hdev->req_result = err;
+               /* req_result is __u32 so error must be positive to be properly
+                * propagated.
+                */
+               hdev->req_result = err < 0 ? -err : err;
                hdev->req_status = HCI_REQ_CANCELED;
 
                wake_up_interruptible(&hdev->req_wait_q);