Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF

After LE Extended Scan times out, conn->sid remains 0xFF,
so the PA sync creation process should be aborted.

Btmon snippet from PA sync with SID=0xFF:

< HCI Command: LE Set Extended.. (0x08|0x0042) plen 6  #74726 [hci0] 863.107927
        Extended scan: Enabled (0x01)
        Filter duplicates: Enabled (0x01)
        Duration: 0 msec (0x0000)
        Period: 0.00 sec (0x0000)
> HCI Event: Command Complete (0x0e) plen 4            #74727 [hci0] 863.109389
      LE Set Extended Scan Enable (0x08|0x0042) ncmd 1
        Status: Success (0x00)
< HCI Command: LE Periodic Ad.. (0x08|0x0044) plen 14  #74728 [hci0] 865.141168
        Options: 0x0000
        Use advertising SID, Advertiser Address Type and address
        Reporting initially enabled
        SID: 0xff
        Adv address type: Random (0x01)
        Adv address: 0D:D7:2C:E7:42:46 (Non-Resolvable)
        Skip: 0x0000
        Sync timeout: 20000 msec (0x07d0)
        Sync CTE type: 0x0000
> HCI Event: Command Status (0x0f) plen 4              #74729 [hci0] 865.143223
      LE Periodic Advertising Create Sync (0x08|0x0044) ncmd 1
        Status: Success (0x00)

Fixes: e2d471b7806b ("Bluetooth: ISO: Fix not using SID from adv report")
Signed-off-by: Yang Li <yang.li@amlogic.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index aa7d7a8ec3ee6435e640e5a1d599b8f5a9b3c7f0..31d72b9683ef52f91d434ad474e0b23bfaca908c 100644 (file)
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -7045,10 +7045,13 @@ static int hci_le_pa_create_sync(struct hci_dev *hdev, void *data)
        /* SID has not been set listen for HCI_EV_LE_EXT_ADV_REPORT to update
         * it.
         */
-       if (conn->sid == HCI_SID_INVALID)
-               __hci_cmd_sync_status_sk(hdev, HCI_OP_NOP, 0, NULL,
-                                        HCI_EV_LE_EXT_ADV_REPORT,
-                                        conn->conn_timeout, NULL);
+       if (conn->sid == HCI_SID_INVALID) {
+               err = __hci_cmd_sync_status_sk(hdev, HCI_OP_NOP, 0, NULL,
+                                              HCI_EV_LE_EXT_ADV_REPORT,
+                                              conn->conn_timeout, NULL);
+               if (err == -ETIMEDOUT)
+                       goto done;
+       }
 
        memset(&cp, 0, sizeof(cp));
        cp.options = qos->bcast.options;
@@ -7078,6 +7081,7 @@ static int hci_le_pa_create_sync(struct hci_dev *hdev, void *data)
                __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_CREATE_SYNC_CANCEL,
                                      0, NULL, HCI_CMD_TIMEOUT);
 
+done:
        hci_dev_clear_flag(hdev, HCI_PA_SYNC);
 
        /* Update passive scan since HCI_PA_SYNC flag has been cleared */