[PATCH] Bluetooth: hci_event: reject incoming conn request when MASTER conn exists

SeungJu Cheon
2026-04-10T10:42:45Z

hci_conn_request_evt() reuses an existing connection without checking
its role. When the existing connection has the MASTER role (outgoing
connection in progress), conn->state is incorrectly overwritten from
BT_CONNECTED or BT_OPEN to BT_CONNECT, causing state machine corruption.

This can lead to use-after-free or state confusion when the connection
is later disconnected.

The issue was observed during VHCI testing:

Thread 1: Local connect() -> conn created (role=MASTER, state=BT_OPEN)
Thread 2: Remote Connection Request received
-> hci_conn_hash_lookup_ba() finds existing MASTER conn
-> conn->state overwritten to BT_CONNECT (no role check!)

Fix by rejecting incoming connection requests when a MASTER connection
to the same address already exists.

Fixes: 70c464256310 ("Bluetooth: Refactor connection request handling")
Signed-off-by: SeungJu Cheon <suunj1331@gmail.com>
---
net/bluetooth/hci_event.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 286529d2e554..3d34cf2e5067 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3327,6 +3327,12 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data,
bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn));
goto unlock;
}
+ } else if (conn->role == HCI_ROLE_MASTER) {
+ /* Reject incoming request when outgoing connection to
+ * the same device is already in progress.
+ */
+ hci_reject_conn(hdev, &ev->bdaddr);
+ goto unlock;
}

memcpy(conn->dev_class, ev->dev_class, 3);
--
2.52.0