Bluetooth: HCI request error handling

When we are building a HCI request with more than one HCI command
and one of the hci_req_add calls fail, we should have some cleanup
routine so the HCI commands already queued on HCI request can be
deleted. Otherwise, we will face some memory leaks issues.

This patch implements the HCI request error handling which is the
following: If a hci_req_add fails, we save the error code in hci_
request. Once hci_req_run is called, we verify the error field. If
it is different from zero, we delete all HCI commands already queued
and return the error code.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 3a9cbf2b55c0dfa5ff37a3b8208fecfc2c11d0a8..332ee5099a52ad0104caa4b015dfad0140c959ef 100644 (file)
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -1042,6 +1042,11 @@ int hci_unregister_cb(struct hci_cb *hcb);
 struct hci_request {
        struct hci_dev          *hdev;
        struct sk_buff_head     cmd_q;
+
+       /* If something goes wrong when building the HCI request, the error
+        * value is stored in this field.
+        */
+       int                     err;
 };
 
 void hci_req_init(struct hci_request *req, struct hci_dev *hdev);

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 4603464b91e2e6002ad2176097b355b59d8c2331..b432baafdf12f6c1363663dde4e2a7f5a35c6d8f 100644 (file)
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2443,6 +2443,7 @@ void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
 {
        skb_queue_head_init(&req->cmd_q);
        req->hdev = hdev;
+       req->err = 0;
 }
 
 int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
@@ -2453,6 +2454,14 @@ int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
 
        BT_DBG("length %u", skb_queue_len(&req->cmd_q));
 
+       /* If an error occured during request building, remove all HCI
+        * commands queued on the HCI request queue.
+        */
+       if (req->err) {
+               skb_queue_purge(&req->cmd_q);
+               return req->err;
+       }
+
        /* Do not allow empty requests */
        if (skb_queue_empty(&req->cmd_q))
                return -ENODATA;
@@ -2529,7 +2538,9 @@ int hci_req_add(struct hci_request *req, u16 opcode, u32 plen, void *param)
 
        skb = hci_prepare_cmd(hdev, opcode, plen, param);
        if (!skb) {
-               BT_ERR("%s no memory for command", hdev->name);
+               BT_ERR("%s no memory for command (opcode 0x%4.4x)",
+                      hdev->name, opcode);
+               req->err = -ENOMEM;
                return -ENOMEM;
        }