[PATCH] Bluetooth: hci_event: Clear explicit connect state on LE connection

[PATCH] Bluetooth: hci_event: Clear explicit connect state on LE connection

[Kevin Dewald]

Since commit 6cd29ec6ae5e ("Bluetooth: hci_sync: Wait for proper events
when connecting LE"), create_le_conn_complete() only runs once the LE
Connection Complete event has been handled, and le_conn_complete_evt()
has already removed the connection parameters from pend_le_conns by
then. hci_connect_le_scan_cleanup() looks the parameters up in
pend_le_conns, so after a successful connection it no longer clears
explicit_connect, nor deletes the parameters that were only created for
the explicit connect.

The parameters of every device connected through an explicit connect,
such as an L2CAP or ATT connect or MGMT Pair Device, are thus left with
explicit_connect set. MGMT Remove Device for all devices then keeps
them as HCI_AUTO_CONN_EXPLICIT instead of freeing them, and if the
device was set to auto-connect and is disconnected, they also stay on
pend_le_conns: the kernel keeps scanning for the device and connects to
it as soon as it advertises, although no one asked for it any more.

Do the cleanup in le_conn_complete_evt() instead, where the explicit
connect request is fulfilled: clear explicit_connect, delete the
parameters if they only existed for it, and put report parameters back
on pend_le_reports. Auto-connect parameters are added back to
pend_le_conns on disconnection, as before.

Fixes: 6cd29ec6ae5e ("Bluetooth: hci_sync: Wait for proper events when connecting LE")
Assisted-by: Claude:claude-opus-5.5
Signed-off-by: Kevin Dewald <kevin@simpleble.org>
---
Reproduced in test-functional on bluetooth-next: after connecting with
Bearer.LE1.Connect and disconnecting, the debugfs device_list of the
central still has the peer with auto_connect 5 (HCI_AUTO_CONN_EXPLICIT),
also after MGMT Remove Device for all devices. With this patch, the
explicit parameters are gone once connected, and only disabled
parameters remain.

This also fixes a test-functional failure seen in CI: when
test_bass_past_transport_acquire runs right before test_bearer_le_connect
on the same hosts, the peer survives the Remove Device of the next
bluetoothd, and the kernel connects to it as soon as the next test
advertises at the same address. test_bearer_le_connect fails 5 out of 5
times in that order without this patch, and passes 5 out of 5 times with
it. The kernel testers and the rest of test-functional pass with it.

A tester case for the device_list check can be sent as well if wanted.

 net/bluetooth/hci_event.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 1f80f2cf6b..dede0b686c 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -6041,6 +6041,28 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
 			hci_conn_put(params->conn);
 			params->conn = NULL;
 		}
+
+		/* An explicit connect request is complete once connected, so
+		 * clean it up here: hci_connect_le_scan_cleanup() no longer
+		 * finds the params since they have just been removed from
+		 * pend_le_conns.
+		 */
+		if (params->explicit_connect) {
+			params->explicit_connect = false;
+
+			switch (params->auto_connect) {
+			case HCI_AUTO_CONN_EXPLICIT:
+				hci_conn_params_del(hdev, &conn->dst,
+						    conn->dst_type);
+				break;
+			case HCI_AUTO_CONN_REPORT:
+				hci_pend_le_list_add(params,
+						     &hdev->pend_le_reports);
+				break;
+			default:
+				break;
+			}
+		}
 	}
 
 	/* If we are central and have subrate parameters stored, queue a

base-commit: 397464709a204da9b8dc3b01d6ea42539d951cd2
-- 
2.53.0

RE: Bluetooth: hci_event: Clear explicit connect state on LE connection

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1814 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1185966/

---Test result---

Test Summary:
CheckPatch                    PASS      1.47 seconds
VerifyFixes                   PASS      0.12 seconds
VerifySignedoff               PASS      0.12 seconds
GitLint                       PASS      0.32 seconds
SubjectPrefix                 PASS      0.12 seconds
BuildKernel                   PASS      29.66 seconds
CheckAllWarning               PASS      34.33 seconds
CheckSparse                   WARNING   46.77 seconds
BuildKernel32                 PASS      30.31 seconds
CheckKernelLLVM               PASS      34.30 seconds
TestRunnerSetup               PASS      723.49 seconds
TestRunner_l2cap-tester       PASS      12.87 seconds
TestRunner_iso-tester         PASS      10.86 seconds
TestRunner_bnep-tester        PASS      3.11 seconds
TestRunner_mgmt-tester        PASS      87.91 seconds
TestRunner_rfcomm-tester      PASS      4.48 seconds
TestRunner_sco-tester         PASS      6.17 seconds
TestRunner_ioctl-tester       PASS      4.64 seconds
TestRunner_mesh-tester        PASS      5.51 seconds
TestRunner_smp-tester         PASS      4.36 seconds
TestRunner_userchan-tester    PASS      3.21 seconds
TestRunner_6lowpan-tester     PASS      4.92 seconds
IncrementalBuild              PASS      28.32 seconds

Details
##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):


https://github.com/bluez/bluetooth-next/pull/939

---
Regards,
Linux Bluetooth