Bluetooth: Fix hci_inquiry ioctl usage

Since the HCI request framework was properly fixed, the hci_req_sync
call, in hci_inquiry, will return as soon as the HCI command completes
(not the Inquiry procedure). However, in inquiry ioctl implementation,
we want to sleep the user process until the inquiry procedure finishes.

This patch changes hci_inquiry so, in case the HCI Inquiry command
was executed successfully, it waits the HCI_INQUIRY flag to be cleared.
This way, the user process will sleep until the inquiry procedure
finishes.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index cfcad5423f1cdba4009fde9050f38cc67ee90774..123992984a7c1271414b28dae7aaaffe41ab2c3d 100644 (file)
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -818,6 +818,12 @@ static void hci_inq_req(struct hci_request *req, unsigned long opt)
        hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
 }
 
+static int wait_inquiry(void *word)
+{
+       schedule();
+       return signal_pending(current);
+}
+
 int hci_inquiry(void __user *arg)
 {
        __u8 __user *ptr = arg;
@@ -849,6 +855,13 @@ int hci_inquiry(void __user *arg)
                                   timeo);
                if (err < 0)
                        goto done;
+
+               /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
+                * cleared). If it is interrupted by a signal, return -EINTR.
+                */
+               if (wait_on_bit(&hdev->flags, HCI_INQUIRY, wait_inquiry,
+                               TASK_INTERRUPTIBLE))
+                       return -EINTR;
        }
 
        /* for unlimited number of responses we will use buffer with

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 8efb9c0d9b2c9b36428324d3f782b052e25fc25a..7e7fbca59439cc10be62d15ca65630db66bc6979 100644 (file)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -48,6 +48,8 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
        }
 
        clear_bit(HCI_INQUIRY, &hdev->flags);
+       smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
+       wake_up_bit(&hdev->flags, HCI_INQUIRY);
 
        hci_dev_lock(hdev);
        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
@@ -1603,6 +1605,9 @@ static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
        if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
                return;
 
+       smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
+       wake_up_bit(&hdev->flags, HCI_INQUIRY);
+
        if (!test_bit(HCI_MGMT, &hdev->dev_flags))
                return;