Bluetooth: Fix HCI_RESET command synchronization

We can't send new commands before a cmd_complete for the HCI_RESET command
shows up.

Reported-by: Mikko Vinni <mmvinni@yahoo.com>
Reported-by: Justin P. Mattock <justinmattock@gmail.com>
Reported-by: Ed Tomlinson <edt@aei.ca>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Tested-by: Justin P. Mattock <justinmattock@gmail.com>
Tested-by: Mikko Vinni <mmvinni@yahoo.com>
Tested-by: Ed Tomlinson <edt@aei.ca>

3 files changed, 10 insertions, 2 deletions

diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index ec6acf2f1c0b..2c0d309c7381 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -84,6 +84,8 @@ enum {
         HCI_SERVICE_CACHE,
         HCI_LINK_KEYS,
         HCI_DEBUG_KEYS,
+
+        HCI_RESET,
 };
 
 /* HCI ioctl defines */
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index b372fb8bcdcf..92b48e257b89 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -186,6 +186,7 @@ static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
         BT_DBG("%s %ld", hdev->name, opt);
 
         /* Reset device */
+        set_bit(HCI_RESET, &hdev->flags);
         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 }
 
@@ -213,8 +214,10 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
         /* Mandatory initialization */
 
         /* Reset */
-        if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks))
+        if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
+                        set_bit(HCI_RESET, &hdev->flags);
                         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
+        }
 
         /* Read Local Supported Features */
         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
@@ -1074,6 +1077,7 @@ static void hci_cmd_timer(unsigned long arg)
 
         BT_ERR("%s command tx timeout", hdev->name);
         atomic_set(&hdev->cmd_cnt, 1);
+        clear_bit(HCI_RESET, &hdev->flags);
         tasklet_schedule(&hdev->cmd_task);
 }
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 3fbfa50c2bff..cebe7588469f 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -183,6 +183,8 @@ static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%x", hdev->name, status);
 
+        clear_bit(HCI_RESET, &hdev->flags);
+
         hci_req_complete(hdev, HCI_OP_RESET, status);
 }
 
@@ -1847,7 +1849,7 @@ static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
         if (ev->opcode != HCI_OP_NOP)
                 del_timer(&hdev->cmd_timer);
 
-        if (ev->ncmd) {
+        if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
                 atomic_set(&hdev->cmd_cnt, 1);
                 if (!skb_queue_empty(&hdev->cmd_q))
                         tasklet_schedule(&hdev->cmd_task);