[PATCH v2] Bluetooth: mgmt: reply to cancelled mgmt commands instead of silently dropping

[PATCH v2] Bluetooth: mgmt: reply to cancelled mgmt commands instead of silently dropping

[Shuai Zhang]

The kernel sets HCI_AUTO_OFF when a controller is first registered and
starts a 2-second timer. On slower boots bluetoothd and the HCI_AUTO_OFF
timer can race: hci_power_off() is already queued while bluetoothd is
still in the middle of its adapter setup sequence. hci_cmd_sync_clear()
then cancels any pending mgmt commands with -ECANCELED, including the
MGMT_OP_REMOVE_ADV_MONITOR sent by reset_adv_monitors() early in the
setup sequence.

When auto_off=1, hci_dev_close_sync() skips __mgmt_power_off() entirely,
so there is no fallback path to reply to the cancelled commands.
mgmt_remove_adv_monitor_complete() silently returns on -ECANCELED, leaving
the command with no reply. Since bluez's mgmt queue is strictly serialised,
this stalls all subsequent commands indefinitely, leaving bluetoothd unable
to register the adapter.

Fix by mapping -ECANCELED to MGMT_STATUS_CANCELLED in mgmt_errno_status()
and removing the early return in mgmt_remove_adv_monitor_complete(), so
bluetoothd receives a reply and can continue normally.

Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
---
 net/bluetooth/mgmt.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index ac4864e56..c660bd3cd 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -301,6 +301,8 @@ static u8 mgmt_errno_status(int err)
 		return MGMT_STATUS_ALREADY_CONNECTED;
 	case -ENOTCONN:
 		return MGMT_STATUS_DISCONNECTED;
+	case -ECANCELED:
+		return MGMT_STATUS_CANCELLED;
 	}
 
 	return MGMT_STATUS_FAILED;
@@ -5675,9 +5677,6 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
 	struct mgmt_pending_cmd *cmd = data;
 	struct mgmt_cp_remove_adv_monitor *cp;
 
-	if (status == -ECANCELED)
-		return;
-
 	hci_dev_lock(hdev);
 
 	cp = cmd->param;
-- 
2.34.1

Re: [PATCH v2] Bluetooth: mgmt: reply to cancelled mgmt commands instead of silently dropping

[Luiz Augusto von Dentz]

Hi Shuai,

On Mon, Aug 17, 2026 at 2:01 AM Shuai Zhang
<shuai.zhang@oss.qualcomm.com> wrote:
>
> The kernel sets HCI_AUTO_OFF when a controller is first registered and
> starts a 2-second timer. On slower boots bluetoothd and the HCI_AUTO_OFF
> timer can race: hci_power_off() is already queued while bluetoothd is
> still in the middle of its adapter setup sequence. hci_cmd_sync_clear()
> then cancels any pending mgmt commands with -ECANCELED, including the
> MGMT_OP_REMOVE_ADV_MONITOR sent by reset_adv_monitors() early in the
> setup sequence.
>
> When auto_off=1, hci_dev_close_sync() skips __mgmt_power_off() entirely,
> so there is no fallback path to reply to the cancelled commands.
> mgmt_remove_adv_monitor_complete() silently returns on -ECANCELED, leaving
> the command with no reply. Since bluez's mgmt queue is strictly serialised,
> this stalls all subsequent commands indefinitely, leaving bluetoothd unable
> to register the adapter.
>
> Fix by mapping -ECANCELED to MGMT_STATUS_CANCELLED in mgmt_errno_status()
> and removing the early return in mgmt_remove_adv_monitor_complete(), so
> bluetoothd receives a reply and can continue normally.
>
> Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
> ---
>  net/bluetooth/mgmt.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
> index ac4864e56..c660bd3cd 100644
> --- a/net/bluetooth/mgmt.c
> +++ b/net/bluetooth/mgmt.c
> @@ -301,6 +301,8 @@ static u8 mgmt_errno_status(int err)
>                 return MGMT_STATUS_ALREADY_CONNECTED;
>         case -ENOTCONN:
>                 return MGMT_STATUS_DISCONNECTED;
> +       case -ECANCELED:
> +               return MGMT_STATUS_CANCELLED;
>         }
>
>         return MGMT_STATUS_FAILED;
> @@ -5675,9 +5677,6 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
>         struct mgmt_pending_cmd *cmd = data;
>         struct mgmt_cp_remove_adv_monitor *cp;
>
> -       if (status == -ECANCELED)
> -               return;
> -
>         hci_dev_lock(hdev);
>
>         cp = cmd->param;
> --
> 2.34.1
>

Sashiko is flagging a couple of problems:

https://sashiko.dev/#/patchset/20260817060134.3298439-1-shuai.zhang%40oss.qualcomm.com

-- 
Luiz Augusto von Dentz

Re: [PATCH v2] Bluetooth: mgmt: reply to cancelled mgmt commands instead of silently dropping

[Shuai Zhang]

Hi Luiz

On 8/18/2026 2:05 AM, Luiz Augusto von Dentz wrote:
> Hi Shuai,
>
> On Mon, Aug 17, 2026 at 2:01 AM Shuai Zhang
> <shuai.zhang@oss.qualcomm.com> wrote:
>> The kernel sets HCI_AUTO_OFF when a controller is first registered and
>> starts a 2-second timer. On slower boots bluetoothd and the HCI_AUTO_OFF
>> timer can race: hci_power_off() is already queued while bluetoothd is
>> still in the middle of its adapter setup sequence. hci_cmd_sync_clear()
>> then cancels any pending mgmt commands with -ECANCELED, including the
>> MGMT_OP_REMOVE_ADV_MONITOR sent by reset_adv_monitors() early in the
>> setup sequence.
>>
>> When auto_off=1, hci_dev_close_sync() skips __mgmt_power_off() entirely,
>> so there is no fallback path to reply to the cancelled commands.
>> mgmt_remove_adv_monitor_complete() silently returns on -ECANCELED, leaving
>> the command with no reply. Since bluez's mgmt queue is strictly serialised,
>> this stalls all subsequent commands indefinitely, leaving bluetoothd unable
>> to register the adapter.
>>
>> Fix by mapping -ECANCELED to MGMT_STATUS_CANCELLED in mgmt_errno_status()
>> and removing the early return in mgmt_remove_adv_monitor_complete(), so
>> bluetoothd receives a reply and can continue normally.
>>
>> Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
>> ---
>>   net/bluetooth/mgmt.c | 5 ++---
>>   1 file changed, 2 insertions(+), 3 deletions(-)
>>
>> diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
>> index ac4864e56..c660bd3cd 100644
>> --- a/net/bluetooth/mgmt.c
>> +++ b/net/bluetooth/mgmt.c
>> @@ -301,6 +301,8 @@ static u8 mgmt_errno_status(int err)
>>                  return MGMT_STATUS_ALREADY_CONNECTED;
>>          case -ENOTCONN:
>>                  return MGMT_STATUS_DISCONNECTED;
>> +       case -ECANCELED:
>> +               return MGMT_STATUS_CANCELLED;
>>          }
>>
>>          return MGMT_STATUS_FAILED;
>> @@ -5675,9 +5677,6 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
>>          struct mgmt_pending_cmd *cmd = data;
>>          struct mgmt_cp_remove_adv_monitor *cp;
>>
>> -       if (status == -ECANCELED)
>> -               return;
>> -
>>          hci_dev_lock(hdev);
>>
>>          cp = cmd->param;
>> --
>> 2.34.1
>>
> Sashiko is flagging a couple of problems:
>
> https://sashiko.dev/#/patchset/20260817060134.3298439-1-shuai.zhang%40oss.qualcomm.com
This is indeed a valid issue. I'll address it in the next revision.

Thanks

shuai


>