[PATCH BlueZ] adapter: Trigger profile connection on inbound device connection

[PATCH BlueZ] adapter: Trigger profile connection on inbound device connection

[Chengyi Zhao]

When a bonded device initiates an inbound ACL connection before the
host sends an outbound one (e.g., after resume the remote wins the
race), BlueZ accepts the ACL link via connected_callback() but does
not establish AVDTP/AVCTP profiles. The remote's subsequent L2CAP
connect for PSM 25 fails with "security block" because the link is
not yet encrypted, and the kernel does not retry. The ACL link stays
up with no audio.

Fix: in connected_callback(), call btd_device_connect_services() for
bonded inbound devices. This initiates outbound profile connections
from the host side. Unlike inbound L2CAP, outbound L2CAP is queued
by the kernel until encryption completes, so it survives the race.
Safe when the host already won: the function returns -EBUSY if
dev->connect or dev->pending is set.
---
 src/adapter.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/adapter.c b/src/adapter.c
index 4ffa32a52..4f1bda4ab 100644
--- a/src/adapter.c
+++ b/src/adapter.c
@@ -9606,6 +9606,9 @@ static void connected_callback(uint16_t index, uint16_t length,
 		adapter_msd_notify(adapter, device, eir_data.msd_list);
 
 	eir_data_free(&eir_data);
+
+	if (device_is_bonded(device, BDADDR_BREDR))
+		btd_device_connect_services(device, NULL);
 }
 
 static void controller_resume_notify(struct btd_adapter *adapter)
-- 
2.50.1

RE: [BlueZ] adapter: Trigger profile connection on inbound device connection

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 6588 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1127225

---Test result---

Test Summary:
CheckPatch                    PASS      0.46 seconds
GitLint                       PASS      0.32 seconds
BuildEll                      PASS      20.06 seconds
BluezMake                     FAIL      516.14 seconds
CheckSmatch                   PASS      306.78 seconds
bluezmakeextell               PASS      100.43 seconds
IncrementalBuild              FAIL      506.59 seconds
ScanBuild                     PASS      964.41 seconds

Details
##############################
Test: BluezMake - FAIL
Desc: Build BlueZ
Output:

tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  766 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  989 | int main(int argc, char *argv[])
      |     ^~~~
monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                             ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/packet.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:

tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  766 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  989 | int main(int argc, char *argv[])
      |     ^~~~
monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                             ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/packet.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
[BlueZ] adapter: Trigger profile connection on inbound device connection

tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  766 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  989 | int main(int argc, char *argv[])
      |     ^~~~
monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                             ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/packet.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2


https://github.com/bluez/bluez/pull/2306

---
Regards,
Linux Bluetooth

RE: [BlueZ] adapter: Trigger profile connection on inbound device connection

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 6588 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1127291

---Test result---

Test Summary:
CheckPatch                    PASS      0.29 seconds
GitLint                       PASS      0.21 seconds
BuildEll                      PASS      20.70 seconds
BluezMake                     FAIL      527.25 seconds
CheckSmatch                   PASS      316.75 seconds
bluezmakeextell               PASS      102.85 seconds
IncrementalBuild              FAIL      554.85 seconds
ScanBuild                     PASS      998.88 seconds

Details
##############################
Test: BluezMake - FAIL
Desc: Build BlueZ
Output:

tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  766 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  989 | int main(int argc, char *argv[])
      |     ^~~~
monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                             ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/packet.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:

tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  766 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  989 | int main(int argc, char *argv[])
      |     ^~~~
monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                             ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/packet.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
[BlueZ] adapter: Trigger profile connection on inbound device connection

tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  766 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  989 | int main(int argc, char *argv[])
      |     ^~~~
monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                             ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/packet.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2


https://github.com/bluez/bluez/pull/2308

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ] adapter: Trigger profile connection on inbound device connection

[Luiz Augusto von Dentz]

Hi,

On Tue, Jul 14, 2026 at 4:21 AM Chengyi Zhao <chengyi.zhao@qq.com> wrote:
>
> When a bonded device initiates an inbound ACL connection before the
> host sends an outbound one (e.g., after resume the remote wins the
> race), BlueZ accepts the ACL link via connected_callback() but does
> not establish AVDTP/AVCTP profiles. The remote's subsequent L2CAP
> connect for PSM 25 fails with "security block" because the link is
> not yet encrypted, and the kernel does not retry. The ACL link stays
> up with no audio.

This sounds like a problem on the remote side if it attempts to
connect without encrypting the link first for AVDTP/AVCTP, so this
seems more like a workaround. Or it is a controller problem, perhaps
the Encryption Changed event has already happened but is arriving
late?

> Fix: in connected_callback(), call btd_device_connect_services() for
> bonded inbound devices. This initiates outbound profile connections
> from the host side. Unlike inbound L2CAP, outbound L2CAP is queued
> by the kernel until encryption completes, so it survives the race.
> Safe when the host already won: the function returns -EBUSY if
> dev->connect or dev->pending is set.
> ---
>  src/adapter.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/src/adapter.c b/src/adapter.c
> index 4ffa32a52..4f1bda4ab 100644
> --- a/src/adapter.c
> +++ b/src/adapter.c
> @@ -9606,6 +9606,9 @@ static void connected_callback(uint16_t index, uint16_t length,
>                 adapter_msd_notify(adapter, device, eir_data.msd_list);
>
>         eir_data_free(&eir_data);
> +
> +       if (device_is_bonded(device, BDADDR_BREDR))
> +               btd_device_connect_services(device, NULL);

The policy plugin is supposed to handle connection policies like this.
You will probably need a grace period to wait for the remote to start
connecting if it is the central; only then should you start connecting
the profiles.

>  }
>
>  static void controller_resume_notify(struct btd_adapter *adapter)
> --
> 2.50.1
>
>


-- 
Luiz Augusto von Dentz