hci_cmd_work overwrites the hdev->sent_cmd which contains the required
info for a hci_request to work. In the real world, it's observed that
a request from hci_le_ext_create_conn_sync could be interrupted by
the authentication (hci_conn_auth) caused by rfcomm_sock_connect. When
it happends, hci_le_ext_create_conn_sync hangs until timeout; If the
LE connection is triggered by MGMT, it freezes the whole MGMT interface.
Signed-off-by: Hsin-chen Chuang <chharry@xxxxxxxxxxxx>
---
net/bluetooth/hci_core.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 34c8dca2069f..e3706889976d 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -4213,8 +4213,11 @@ static void hci_cmd_work(struct work_struct *work)
BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
- /* Send queued commands */
- if (atomic_read(&hdev->cmd_cnt)) {
+ /* Send queued commands. Don't send the command when there is a pending
+ * hci_request because the request callbacks would be overwritten.
+ */
+ if (atomic_read(&hdev->cmd_cnt) &&
+ !hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
skb = skb_dequeue(&hdev->cmd_q);
if (!skb)
return;
--
2.43.0.687.g38aa6559b0-goog
