Bluetooth: Ignore CC events not matching the last HCI command

[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / hci_event.c

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index dc2bcf91baf4393dbb83d2d7ed0777ffc2996a68..039efc65f092ca6ef9dc978575cc7cd2fc78e824 100644 (file)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3053,6 +3053,12 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
        hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
                             req_complete_skb);
 
+       if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
+               bt_dev_err(hdev,
+                          "unexpected event for opcode 0x%4.4x", *opcode);
+               return;
+       }
+
        if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
                queue_work(hdev->workqueue, &hdev->cmd_work);
 }
@@ -3156,6 +3162,12 @@ static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
                hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
                                     req_complete_skb);
 
+       if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
+               bt_dev_err(hdev,
+                          "unexpected event for opcode 0x%4.4x", *opcode);
+               return;
+       }
+
        if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
                queue_work(hdev->workqueue, &hdev->cmd_work);
 }