Re: [PATCH v2] Bluetooth: mgmt: reply to cancelled mgmt commands instead of silently dropping

Hi Shuai,

On Mon, Aug 17, 2026 at 2:01 AM Shuai Zhang
<[email protected]> wrote:
>
> The kernel sets HCI_AUTO_OFF when a controller is first registered and
> starts a 2-second timer. On slower boots bluetoothd and the HCI_AUTO_OFF
> timer can race: hci_power_off() is already queued while bluetoothd is
> still in the middle of its adapter setup sequence. hci_cmd_sync_clear()
> then cancels any pending mgmt commands with -ECANCELED, including the
> MGMT_OP_REMOVE_ADV_MONITOR sent by reset_adv_monitors() early in the
> setup sequence.
>
> When auto_off=1, hci_dev_close_sync() skips __mgmt_power_off() entirely,
> so there is no fallback path to reply to the cancelled commands.
> mgmt_remove_adv_monitor_complete() silently returns on -ECANCELED, leaving
> the command with no reply. Since bluez's mgmt queue is strictly serialised,
> this stalls all subsequent commands indefinitely, leaving bluetoothd unable
> to register the adapter.
>
> Fix by mapping -ECANCELED to MGMT_STATUS_CANCELLED in mgmt_errno_status()
> and removing the early return in mgmt_remove_adv_monitor_complete(), so
> bluetoothd receives a reply and can continue normally.
>
> Signed-off-by: Shuai Zhang <[email protected]>
> ---
>  net/bluetooth/mgmt.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
> index ac4864e56..c660bd3cd 100644
> --- a/net/bluetooth/mgmt.c
> +++ b/net/bluetooth/mgmt.c
> @@ -301,6 +301,8 @@ static u8 mgmt_errno_status(int err)
>                 return MGMT_STATUS_ALREADY_CONNECTED;
>         case -ENOTCONN:
>                 return MGMT_STATUS_DISCONNECTED;
> +       case -ECANCELED:
> +               return MGMT_STATUS_CANCELLED;
>         }
>
>         return MGMT_STATUS_FAILED;
> @@ -5675,9 +5677,6 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
>         struct mgmt_pending_cmd *cmd = data;
>         struct mgmt_cp_remove_adv_monitor *cp;
>
> -       if (status == -ECANCELED)
> -               return;
> -
>         hci_dev_lock(hdev);
>
>         cp = cmd->param;
> --
> 2.34.1
>

Sashiko is flagging a couple of problems:

https://sashiko.dev/#/patchset/20260817060134.3298439-1-shuai.zhang%40oss.qualcomm.com

-- 
Luiz Augusto von Dentz