Skip to content

Commit 71e9588

Browse files
pvVudentz
authored andcommitted
Bluetooth: ISO: use correct CIS order in Set CIG Parameters event
The order of CIS handle array in Set CIG Parameters response shall match the order of the CIS_ID array in the command (Core v5.3 Vol 4 Part E Sec 7.8.97). We send CIS_IDs mainly in the order of increasing CIS_ID (but with "last" CIS first if it has fixed CIG_ID). In handling of the reply, we currently assume this is also the same as the order of hci_conn in hdev->conn_hash, but that is not true. Match the correct hci_conn to the correct handle by matching them based on the CIG+CIS combination. The CIG+CIS combination shall be unique for ISO_LINK hci_conn at state >= BT_BOUND, which we maintain in hci_le_set_cig_params. Fixes: 26afbd8 ("Bluetooth: Add initial implementation of CIS connections") Signed-off-by: Pauli Virtanen <[email protected]> Signed-off-by: Luiz Augusto von Dentz <[email protected]>
1 parent 6c242c6 commit 71e9588

File tree

2 files changed

+28
-19
lines changed

2 files changed

+28
-19
lines changed

include/net/bluetooth/hci_core.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1202,7 +1202,8 @@ static inline struct hci_conn *hci_conn_hash_lookup_cis(struct hci_dev *hdev,
12021202
if (id != BT_ISO_QOS_CIS_UNSET && id != c->iso_qos.ucast.cis)
12031203
continue;
12041204

1205-
if (ba_type == c->dst_type && !bacmp(&c->dst, ba)) {
1205+
/* Match destination address if set */
1206+
if (!ba || (ba_type == c->dst_type && !bacmp(&c->dst, ba))) {
12061207
rcu_read_unlock();
12071208
return c;
12081209
}

net/bluetooth/hci_event.c

Lines changed: 26 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -3804,48 +3804,56 @@ static u8 hci_cc_le_set_cig_params(struct hci_dev *hdev, void *data,
38043804
struct sk_buff *skb)
38053805
{
38063806
struct hci_rp_le_set_cig_params *rp = data;
3807+
struct hci_cp_le_set_cig_params *cp;
38073808
struct hci_conn *conn;
3808-
int i = 0;
3809+
u8 status = rp->status;
3810+
int i;
38093811

38103812
bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
38113813

3814+
cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_CIG_PARAMS);
3815+
if (!cp || rp->num_handles != cp->num_cis || rp->cig_id != cp->cig_id) {
3816+
bt_dev_err(hdev, "unexpected Set CIG Parameters response data");
3817+
status = HCI_ERROR_UNSPECIFIED;
3818+
}
3819+
38123820
hci_dev_lock(hdev);
38133821

3814-
if (rp->status) {
3822+
if (status) {
38153823
while ((conn = hci_conn_hash_lookup_cig(hdev, rp->cig_id))) {
38163824
conn->state = BT_CLOSED;
3817-
hci_connect_cfm(conn, rp->status);
3825+
hci_connect_cfm(conn, status);
38183826
hci_conn_del(conn);
38193827
}
38203828
goto unlock;
38213829
}
38223830

3823-
rcu_read_lock();
3831+
/* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2553
3832+
*
3833+
* If the Status return parameter is zero, then the Controller shall
3834+
* set the Connection_Handle arrayed return parameter to the connection
3835+
* handle(s) corresponding to the CIS configurations specified in
3836+
* the CIS_IDs command parameter, in the same order.
3837+
*/
3838+
for (i = 0; i < rp->num_handles; ++i) {
3839+
conn = hci_conn_hash_lookup_cis(hdev, NULL, 0, rp->cig_id,
3840+
cp->cis[i].cis_id);
3841+
if (!conn || !bacmp(&conn->dst, BDADDR_ANY))
3842+
continue;
38243843

3825-
list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
3826-
if (conn->type != ISO_LINK ||
3827-
conn->iso_qos.ucast.cig != rp->cig_id ||
3828-
conn->state == BT_CONNECTED)
3844+
if (conn->state != BT_BOUND && conn->state != BT_CONNECT)
38293845
continue;
38303846

3831-
conn->handle = __le16_to_cpu(rp->handle[i++]);
3847+
conn->handle = __le16_to_cpu(rp->handle[i]);
38323848

38333849
bt_dev_dbg(hdev, "%p handle 0x%4.4x parent %p", conn,
38343850
conn->handle, conn->parent);
38353851

38363852
/* Create CIS if LE is already connected */
3837-
if (conn->parent && conn->parent->state == BT_CONNECTED) {
3838-
rcu_read_unlock();
3853+
if (conn->parent && conn->parent->state == BT_CONNECTED)
38393854
hci_le_create_cis(conn);
3840-
rcu_read_lock();
3841-
}
3842-
3843-
if (i == rp->num_handles)
3844-
break;
38453855
}
38463856

3847-
rcu_read_unlock();
3848-
38493857
unlock:
38503858
hci_dev_unlock(hdev);
38513859

0 commit comments

Comments
 (0)