linux-kernel - [Bluetooth] BUG: New Opcode sent before the previous one completed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <5d20a61d.298e.19750ec34ab.Coremail.mly19891201@163.com>
Date: Mon, 9 Jun 2025 03:02:26 +0800 (CST)
From: mly19891201  <mly19891201@....com>
To: linux-bluetooth@...r.kernel.org
Cc: linux-kernel@...r.kernel.org
Subject: [Bluetooth] BUG: New Opcode sent before the previous one completed

Hello.

System: 6.12.31-gentoo-dist

Bluetooth adapter:  UGREEN BT5.4  CM748.  

Bluetooth Chip: Barrot.  

ID  33fa:0010


System log:

2025/6/8 00:39	kernel	usb 5-4: new full-speed USB device number 5 using xhci_hcd
2025/6/8 00:39	kernel	usb 5-4: New USB device found, idVendor=33fa, idProduct=0010, bcdDevice=88.91
2025/6/8 00:39	kernel	usb 5-4: New USB device strings: Mfr=0, Product=2, SerialNumber=0
2025/6/8 00:39	kernel	usb 5-4: Product: UGREEN BT5.4 Adapter
2025/6/8 00:39	systemd	Starting Load/Save RF Kill Switch Status...
2025/6/8 00:39	systemd	Reached target Bluetooth.
2025/6/8 00:39	systemd	Reached target Bluetooth Support.
2025/6/8 00:39	systemd	Started Load/Save RF Kill Switch Status.
2025/6/8 00:39	kernel	Bluetooth: hci0: Opcode 0x1005 failed: -110
2025/6/8 00:39	kernel	Bluetooth: hci0: command 0x1005 tx timeout
2025/6/8 00:39	systemd	systemd-rfkill.service: Deactivated successfully.

Wireshark (Email attachments):

120	16.079306	host	5.4.1	        USB	64	URB_INTERRUPT in
121	16.079332	host	controller	HCI_CMD	68	Sent Read Local Extended Features
122	16.087475	5.4.0	host	        HCI_USB	64	Rcvd
123	16.096297	5.4.1	host	        HCI_USB	81	Rcvd Fragment
124	16.096303	host	5.4.1	        USB	64	URB_INTERRUPT in
125	16.096329	host	controller	HCI_CMD	67	Sent Read Buffer Size
126	16.099104	5.4.0	host	        HCI_USB	64	Rcvd
127	16.099303	controller	host	HCI_EVT	77	Rcvd Command Complete (Read Local Extended Features)
128	16.099305	host	5.4.1	        USB	64	URB_INTERRUPT in
129	18.221695	5.4.1	host	        USB	64	URB_INTERRUPT in
130	18.221726	5.4.2	host	        USB	64	URB_BULK in
131	18.221783	5.4.2	host	        USB	64	URB_BULK in
132	20.721814	host	5.1.0	        USBHUB	64	SET_FEATURE Request    [Port 4: PORT_SUSPEND]
133	20.734946	5.1.0	host	        USBHUB	64	SET_FEATURE Response   [Port 4: PORT_SUSPEND]
134	20.748294	5.1.1	host	        USB	64	URB_INTERRUPT in

Line 121 sent command, the response size 17, larger than maxsize, so we get line 123 and line 127.
After line 123, possibly, hci system get the complete signal, new command sent in line 125. this command never get response.

I patch my kernel source to cancel  'hci_read_local_ext_features' in the hci_init2[] and hci_init3[] in file hci_sync.c.
It worked.
Content of type "text/html" skipped

Download attachment "wireshark_log.pcapng" of type "application/octet-stream" (14332 bytes)