Skip to content

[PW_SID:1154959] [v2] Bluetooth: hci_sock: Reject raw operations while powering down - #677

Open
BluezTestBot wants to merge 6 commits into
workflowfrom
1154959
Open

[PW_SID:1154959] [v2] Bluetooth: hci_sock: Reject raw operations while powering down#677
BluezTestBot wants to merge 6 commits into
workflowfrom
1154959

Conversation

@BluezTestBot

Copy link
Copy Markdown

From: Chen Zhang zhangchen01@kylinos.cn

When an adapter is powered off with devices still connected, the
shutdown sequence issues an HCI reset which returns Command Complete
while the controller firmware is still rebooting. A command sent
concurrently through a raw socket during this window (e.g. hciconfig
queries triggered by the Bluetooth status change) can leave the
firmware in a stuck state where it stops answering any HCI command.
The subsequent power on then fails with 'Opcode 0x0c03 failed: -110'
and the adapter is lost until reboot or re-enumeration.

Unlike the ioctl paths (HCIDEVUP/HCIDEVDOWN/HCIDEVRESET) which are
already serialized by hci_req_sync_lock against the power off
sequence, raw socket command transmission goes directly to the
transport through hdev->send() without taking the lock, so it has to
be rejected explicitly:

  • hci_sock_sendmsg(): reject with -ENETDOWN while HCI_POWERING_DOWN
    is set, extending the existing HCI_UP check
  • hci_sock_bind(): fail early with -EBUSY while HCI_POWERING_DOWN is
    set, avoiding HCI_USER_CHANNEL to be toggled (and the controller
    to be opened as user channel) right after power off

Changes in v2:

  • Drop the HCI_POWERING_DOWN checks in hci_dev_open()/hci_dev_close()/
    hci_dev_reset() (hci_core.c): those paths are already serialized by
    hci_req_sync_lock against the power off sequence, checking the flag
    outside the lock is redundant (as pointed out in review).

Signed-off-by: Chen Zhang zhangchen01@kylinos.cn

net/bluetooth/hci_sock.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

tedd-an and others added 6 commits August 31, 2026 18:29
This patch adds workflow files for ci:

[sync.yml]
 - The workflow file for scheduled work
 - Sync the repo with upstream repo and rebase the workflow branch
 - Review the patches in the patchwork and creates the PR if needed

[ci.yml]
 - The workflow file for CI tasks
 - Run CI tests when PR is created

Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
This replaces the bzcafe action with bluez/action-ci so we can maintain
everything in the github bluez organization

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This attempts to sync every 5 minutes instead of 30.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
bluez/action-ci uses master as default branch for workflow which is
incorrect for kernel

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
The CI action now creates individual GitHub Check Runs per test, which
requires 'checks: write' permission on the GITHUB_TOKEN. Also make the
pull_request trigger types explicit to include 'reopened', allowing CI
to be retriggered by closing and reopening a PR.
When an adapter is powered off with devices still connected, the
shutdown sequence issues an HCI reset which returns Command Complete
while the controller firmware is still rebooting. A command sent
concurrently through a raw socket during this window (e.g. hciconfig
queries triggered by the Bluetooth status change) can leave the
firmware in a stuck state where it stops answering any HCI command.
The subsequent power on then fails with 'Opcode 0x0c03 failed: -110'
and the adapter is lost until reboot or re-enumeration.

Unlike the ioctl paths (HCIDEVUP/HCIDEVDOWN/HCIDEVRESET) which are
already serialized by hci_req_sync_lock against the power off
sequence, raw socket command transmission goes directly to the
transport through hdev->send() without taking the lock, so it has to
be rejected explicitly:

- hci_sock_sendmsg(): reject with -ENETDOWN while HCI_POWERING_DOWN
  is set, extending the existing HCI_UP check
- hci_sock_bind(): fail early with -EBUSY while HCI_POWERING_DOWN is
  set, avoiding HCI_USER_CHANNEL to be toggled (and the controller
  to be opened as user channel) right after power off

Changes in v2:
- Drop the HCI_POWERING_DOWN checks in hci_dev_open()/hci_dev_close()/
  hci_dev_reset() (hci_core.c): those paths are already serialized by
  hci_req_sync_lock against the power off sequence, checking the flag
  outside the lock is redundant (as pointed out in review).

Signed-off-by: Chen Zhang <zhangchen01@kylinos.cn>
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

CheckPatch
Desc: Run checkpatch.pl script
Duration: 0.74 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

VerifyFixes
Desc: Verify Fixes tag format and validity
Duration: 0.14 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

VerifySignedoff
Desc: Verify Signed-off-by chain
Duration: 0.14 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

GitLint
Desc: Run gitlint
Duration: 0.63 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

SubjectPrefix
Desc: Check subject contains "Bluetooth" prefix
Duration: 0.13 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

BuildKernel
Desc: Build Kernel for Bluetooth
Duration: 27.28 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

CheckAllWarning
Desc: Run linux kernel with all warning enabled
Duration: 30.17 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

CheckSparse
Desc: Run sparse tool with linux kernel
Duration: 28.98 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

BuildKernel32
Desc: Build 32bit Kernel for Bluetooth
Duration: 26.49 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

CheckKernelLLVM
Desc: Build kernel with LLVM + context analysis
Duration: 0.00 seconds
Result: SKIP
Output:

Clang not found

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

TestRunnerSetup
Desc: Setup kernel and bluez for test-runner
Duration: 505.16 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

TestRunner_l2cap-tester
Desc: Run l2cap-tester with test-runner
Duration: 67.03 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

TestRunner_iso-tester
Desc: Run iso-tester with test-runner
Duration: 100.00 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

TestRunner_bnep-tester
Desc: Run bnep-tester with test-runner
Duration: 19.22 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

TestRunner_mgmt-tester
Desc: Run mgmt-tester with test-runner
Duration: 218.35 seconds
Result: FAIL
Output:

Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4

Failed Test Cases
Read Exp Feature - Success                           Failed       0.240 seconds

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

TestRunner_rfcomm-tester
Desc: Run rfcomm-tester with test-runner
Duration: 26.08 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

TestRunner_sco-tester
Desc: Run sco-tester with test-runner
Duration: 31.77 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

TestRunner_ioctl-tester
Desc: Run ioctl-tester with test-runner
Duration: 27.17 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

TestRunner_mesh-tester
Desc: Run mesh-tester with test-runner
Duration: 26.19 seconds
Result: FAIL
Output:

Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Timed out    2.524 seconds
Mesh - Send cancel - 2                               Timed out    1.988 seconds

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

TestRunner_smp-tester
Desc: Run smp-tester with test-runner
Duration: 23.48 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

TestRunner_userchan-tester
Desc: Run userchan-tester with test-runner
Duration: 20.25 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

TestRunner_6lowpan-tester
Desc: Run 6lowpan-tester with test-runner
Duration: 23.50 seconds
Result: PASS

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

IncrementalBuild
Desc: Incremental build with the patches in the series
Duration: 25.58 seconds
Result: PASS

@github-actions
github-actions Bot force-pushed the workflow branch 6 times, most recently from 8f53a45 to d690686 Compare September 4, 2026 19:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants