Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-5029-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
From: bugzilla-daemon@kernel.org
To: linux-bluetooth@vger.kernel.org
Subject: [Bug 218914] New: Missing HCI event REMOTE_NAME Causing Subsequent
 Bluetooth Connection Failures
Date: Thu, 30 May 2024 02:01:54 +0000
Message-ID: <bug-218914-62941@https.bugzilla.kernel.org/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Auto-Submitted: auto-generated
Precedence: bulk
MIME-Version: 1.0

https://bugzilla.kernel.org/show_bug.cgi?id=3D218914

            Bug ID: 218914
           Summary: Missing HCI event REMOTE_NAME Causing Subsequent
                    Bluetooth Connection Failures
           Product: Drivers
           Version: 2.5
    Kernel Version: 6.7.9
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P3
         Component: Bluetooth
          Assignee: linux-bluetooth@vger.kernel.org
          Reporter: yuxuanhu@buaa.edu.cn
                CC: baijiaju1990@gmail.com, johan.hedberg@gmail.com,
                    linux-bluetooth@vger.kernel.org, luiz.dentz@gmail.com,
                    marcel@holtmann.org
        Regression: No

Hi All,

We round a possible bug during 2 consecutive rounds of RFCOMM connections in
kernel 6.7.9:

(1) During the connection process, the host sends a HCI command REMOTE_NAME=
_REQ
to request the name of the remote device. Normally, the controller responds=
 to
it with a HCI event COMMAND_STATUS(REMOTE_NAME_REQ) and then sends a HCI ev=
ent
REMOTE_NAME containing the remote device's name.

(2) Upon receiving COMMAND_STATUS(REMOTE_NAME_REQ), function
hci_cmd_status_evt(net/bluetooth/hci_event.c:4356) is called, which in turn
invokes function handle_cmd_cnt_and_timer to clear the timer.

(3) Since the timer has been clear, the host indefinitely waits for the HCI
event REMOTE_NAME. If the controller fails to send this packet, the only
recourse is for the user to manually terminate the connection process.

(4.1) Because the connection state is only set to CONNECTED upon receiving =
the
HCI event REMOTE_NAME (hci_remote_name_evt
->hci_check_pending_name->mgmt_device_connected), the remote device remains
unconnected in (3).

(4.2) We tried to reconnect for multiple times, but host is unable to send =
the
HCI command CREATE_CONNECTION, resulting in subsequent failures to establis=
h a
connection with the device.

We believe it might be necessary to set a timeout while waiting for the HCI
event REMOTE_NAME.

Thank you for reading this. Appreciating for any possible reply.

Attachment 1: Log file containing HCI packet contents.
Attachment 2: ftrace records of bluetooth and rfcomm modules.

Best Wishes,
Yuxuan Hu

--=20
You may reply to this email to add a comment.

You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.=