Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To:     linux-bluetooth@vger.kernel.org
Subject: [PATCH BlueZ] a2dp: Fix not detecting transport connection collision
Date:   Fri, 16 Sep 2022 14:42:35 -0700
Message-Id: <20220916214235.1120979-1-luiz.dentz@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Some headsets appears to attempt to connect back after receiving
AVDTP_Open which would cause unexpected transitions since setup->io
and stream->io would not be in sync:

> ACL Data RX: Handle 70 flags 0x02 dlen 6
      Channel: 64 len 2 [PSM 25 mode Basic (0x00)] {chan 0}
      AVDTP: Open (0x06) Response Accept (0x02) type 0x00 label 2 nosp 0
< ACL Data TX: Handle 70 flags 0x00 dlen 12
      L2CAP: Connection Request (0x02) ident 6 len 4
        PSM: 25 (0x0019)
        Source CID: 67
> ACL Data RX: Handle 70 flags 0x02 dlen 12
      L2CAP: Connection Request (0x02) ident 10 len 4
        PSM: 25 (0x0019)
        Source CID: 68
< ACL Data TX: Handle 70 flags 0x00 dlen 16
      L2CAP: Connection Response (0x03) ident 10 len 8
        Destination CID: 68
        Source CID: 68
        Result: Connection pending (0x0001)
        Status: Authorization pending (0x0002)
< ACL Data TX: Handle 70 flags 0x00 dlen 16
      L2CAP: Connection Response (0x03) ident 10 len 8
        Destination CID: 68
        Source CID: 68
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)
> ACL Data RX: Handle 70 flags 0x02 dlen 16
      L2CAP: Connection Response (0x03) ident 6 len 8
        Destination CID: 69
        Source CID: 67
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)

Fixes: https://github.com/bluez/bluez/issues/327
---
 profiles/audio/a2dp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c
index 276512208e13..47b5dd7c3d25 100644
--- a/profiles/audio/a2dp.c
+++ b/profiles/audio/a2dp.c
@@ -2522,7 +2522,8 @@ static void confirm_cb(GIOChannel *io, gpointer data)
 		if (!setup || !setup->stream)
 			goto drop;
 
-		if (setup->io) {
+		if (setup->io || avdtp_stream_get_transport(setup->stream,
+						NULL, NULL, NULL, NULL)) {
 			error("transport channel already exists");
 			goto drop;
 		}
-- 
2.37.3