BLE: Disconnecting/closing GATT directly after connect sometimes has no effect due to race conditions [37121040]

Obsolete

Bug

[AOSP] assigned

Status Update

No update yet.

Description

em...@gmail.com

created issue #1

Sep 24, 2016 12:35PM

Steps to reproduce:
1. Call BluetoothAdapter.getDefaultAdapter().getRemoteDevice("XX:XX:XX:XX:XX:XX").connectGatt(context, true, new BluetoothGattCallback(){}).close();

Expected outcome:
Android should not attempt to connect to the Bluetooth Low Energy device and the GATT object should be released.

What happens instead:
Android continues to have a connection open to the GATT device and the BluetoothGatt object is not released properly, until the app is terminated.

Cause:
In BluetoothGatt.java in the SDK (

https://android.googlesource.com/platform/frameworks/base/+/8e970d6ab4850ca23163bad5773cf5cc2e7ff896/core/java/android/bluetooth/BluetoothGatt.java), once the BluetoothGatt object has been created a registerApp call is made. Once that is complete, onClientRegistered is called asynchronously. In that callback it initiates a connection through the mService.clientConnect method. BUT, if disconnect(), close() or connect() is called before the onClientRegistered callback has been executed, the action does not take effect properly.

Possible workaround for app developers:
Each app needs to have a timer that makes sure the affected methods are not called in some amount of time after the BluetoothGatt object has been created. Since you don't know how much time it takes until onClientRegistered is called internally, this is still not a water proof workaround.

Suggested fix:
If the affected methods can't be executed since the client has not yet been registered, save that to some state. Once onClientRegistered is called, check if those methods were called (in a thread safe manner) and take proper action.

Affected versions: All Android versions so far supporting BLE (latest I've tested is Nougat 7.0)

Logcat when calling close right after connectGatt:

09-24 13:48:27.850 D/BluetoothManagerService( 861): Message: 20
09-24 13:48:27.850 D/BluetoothManagerService( 861): Added callback: android.bluetooth.IBluetoothManagerCallback$Stub$Proxy@21210a:true
09-24 13:48:27.854 D/BluetoothGatt(15142): connect() - device: 80:E4:DA:70:8D:EB, auto: true
09-24 13:48:27.854 D/BluetoothGatt(15142): registerApp()
09-24 13:48:27.854 D/BluetoothGatt(15142): registerApp() - UUID=373f3bfb-cbfb-4386-836f-35f641628602
09-24 13:48:27.855 D/BtGatt.GattService( 3198): registerClient() - UUID=373f3bfb-cbfb-4386-836f-35f641628602
09-24 13:48:27.855 D/BluetoothGatt(15142): close()
09-24 13:48:27.855 D/BluetoothGatt(15142): unregisterApp() - mClientIf=0
09-24 13:48:27.855 D/BtGatt.GattService( 3198): onClientRegistered() - UUID=373f3bfb-cbfb-4386-836f-35f641628602, clientIf=6
09-24 13:48:27.856 D/BluetoothGatt(15142): onClientRegistered() - status=0 clientIf=6
09-24 13:48:27.856 D/BtGatt.GattService( 3198): clientConnect() - address=80:E4:DA:70:8D:EB, isDirect=false
09-24 13:48:27.856 D/bt_btif_config( 3198): btif_get_address_type: Device [80:e4:da:70:8d:eb] address type 0
09-24 13:48:27.856 D/bt_btif_config( 3198): btif_get_device_type: Device [80:e4:da:70:8d:eb] type 2

When peripheral finally connects:
09-24 13:48:28.037 W/bt_smp ( 3198): smp_br_connect_callback is called on unexpected transport 2
09-24 13:48:28.038 W/bt_btif ( 3198): bta_dm_acl_change info: 0x0
09-24 13:48:28.038 D/bt_btif_dm( 3198): remote version info [80:e4:da:70:8d:eb]: 0, 0, 0
09-24 13:48:28.052 E/BluetoothRemoteDevices( 3198): state12newState0
09-24 13:48:28.054 D/BtGatt.GattService( 3198): onConnected() - clientIf=6, connId=6, address=80:E4:DA:70:8D:EB
09-24 13:48:28.059 D/BluetoothGatt(15142): onClientConnectionState() - status=0 clientIf=6 device=80:E4:DA:70:8D:EB

Comments

am...@google.com <am...@google.com> #2Nov 29, 2016 11:53AM

Status: New

Hi,

Please share the bugreport taken on latest N release NPF26F

Android bug report:
After reproducing the issue, navigate to developer settings, ensure ‘USB debugging’ is enabled, then enable ‘Bug report shortcut’. To take bug report, hold the power button and select the ‘Take bug report’ option.

Note: Please upload the bug report to google drive and share the folder to android-bugreport@google.com, then share the link here.

em...@gmail.com <em...@gmail.com> #3Nov 29, 2016 12:36PM

I attach bug report from NPF26F (Nexus 5X) and extracted the relevant parts here below. However the file where I pinpointed the location of the bug has not been updated with respect to this bug since I posted this issue so it clearly has not been fixed yet.

11-29 13:17:16.298 864 899 D BluetoothManagerService: Added callback: android.bluetooth.IBluetoothManagerCallback$Stub$Proxy@d0928e:true
11-29 13:17:16.302 26784 26784 D BluetoothGatt: connect() - device: 80:E4:DA:70:B2:30, auto: false
11-29 13:17:16.302 26784 26784 D BluetoothGatt: registerApp()
11-29 13:17:16.302 26784 26784 D BluetoothGatt: registerApp() - UUID=919fb9a0-d8d4-42de-8dba-d081631faf99
11-29 13:17:16.304 15744 15789 D BtGatt.GattService: registerClient() - UUID=919fb9a0-d8d4-42de-8dba-d081631faf99
11-29 13:17:16.304 26784 26784 D BluetoothGatt: close()
11-29 13:17:16.304 26784 26784 D BluetoothGatt: unregisterApp() - mClientIf=0
11-29 13:17:16.304 15744 15763 D BtGatt.GattService: onClientRegistered() - UUID=919fb9a0-d8d4-42de-8dba-d081631faf99, clientIf=7
11-29 13:17:16.305 26784 26796 D BluetoothGatt: onClientRegistered() - status=0 clientIf=7
11-29 13:17:16.306 15744 15795 D BtGatt.GattService: clientConnect() - address=80:E4:DA:70:B2:30, isDirect=true
11-29 13:17:16.306 15744 15763 D bt_btif_config: btif_get_address_type: Device [80:e4:da:70:b2:30] address type 0
11-29 13:17:16.306 15744 15763 D bt_btif_config: btif_get_device_type: Device [80:e4:da:70:b2:30] type 2
11-29 13:17:16.306 15744 15786 W bt_l2cap: L2CAP - LE - cannot start new connection at conn st: 2
11-29 13:17:25.529 15744 15786 W bt_smp : smp_br_connect_callback is called on unexpected transport 2
11-29 13:17:25.530 15744 15786 W bt_btif : bta_dm_acl_change info: 0x0
11-29 13:17:25.530 15744 15763 D bt_btif_dm: remote version info [80:e4:da:70:b2:30]: 0, 0, 0
11-29 13:17:25.530 15744 15786 E bt_btif : bta_gattc_cache_load: can't open GATT cache file /data/misc/bluetooth/gatt_cache_80e4da70b230 for reading, error: Permission denied
11-29 13:17:25.532 15744 15763 E BluetoothRemoteDevices: state12newState0
11-29 13:17:25.536 15744 15763 D BtGatt.GattService: onConnected() - clientIf=7, connId=7, address=80:E4:DA:70:B2:30
11-29 13:17:25.537 26784 26797 D BluetoothGatt: onClientConnectionState() - status=0 clientIf=7 device=80:E4:DA:70:B2:30
11-29 13:17:25.537 26784 26797 D MainActivity: connected1
11-29 13:17:26.174 15744 15786 W bt_bta_gattc: bta_gattc_explore_srvc no more services found
11-29 13:17:27.502 864 899 D BluetoothManagerService: Message: 20
11-29 13:17:27.503 864 899 D BluetoothManagerService: Added callback: android.bluetooth.IBluetoothManagerCallback$Stub$Proxy@4f9fff0:true
11-29 13:17:40.442 15744 15786 W bt_btif : bta_gattc_conn_cback() - cif=3 connected=0 conn_id=3 reason=0x0013
11-29 13:17:40.442 15744 15786 W bt_btif : bta_gattc_conn_cback() - cif=4 connected=0 conn_id=4 reason=0x0013
11-29 13:17:40.442 15744 15786 W bt_btif : bta_gattc_conn_cback() - cif=5 connected=0 conn_id=5 reason=0x0013
11-29 13:17:40.443 15744 15786 W bt_btif : bta_gattc_conn_cback() - cif=6 connected=0 conn_id=6 reason=0x0013
11-29 13:17:40.443 15744 15786 W bt_btif : bta_gattc_conn_cback() - cif=7 connected=0 conn_id=7 reason=0x0013
11-29 13:17:40.443 15744 15786 I bt_btm_sec: btm_sec_disconnected clearing pending flag handle:17 reason:19
11-29 13:17:40.444 15744 15763 D BtGatt.GattService: onDisconnected() - clientIf=7, connId=7, address=80:E4:DA:70:B2:30
11-29 13:17:40.445 26784 26798 D BluetoothGatt: onClientConnectionState() - status=19 clientIf=7 device=80:E4:DA:70:B2:30
11-29 13:17:40.446 26784 26798 D MainActivity: disconnected1 19
11-29 13:17:40.446 15744 15763 E BluetoothRemoteDevices: state12newState1
11-29 13:17:40.453 15744 15744 D BluetoothMapService: onReceive
11-29 13:17:40.453 15744 15744 D BluetoothMapService: onReceive: android.bluetooth.device.action.ACL_DISCONNECTED

deleted

Restricted

0 B

am...@google.com <am...@google.com> #4Nov 30, 2016 09:03AM

Assigned to am...@google.com.

Hi,
We have passed this defect on to the development team and will update this issue with more information as it becomes available.
Thanks

[Deleted User] <[Deleted User]> #5Mar 29, 2017 04:54PM

Any update on this issue? I am still getting this error.

sa...@google.com <sa...@google.com> #6Nov 13, 2019 09:36AM

We will be closing this bug as Obsolete. If you still think this issue is reproducible and relevant in the latest Android release (Android Q), please attach a new bug report along with reproduction details. If a reply is not received within the next 14 days, this issue will be closed. Thank you for your understanding.

em...@gmail.com <em...@gmail.com> #7Nov 26, 2019 05:08PM

This is still a problem. The bug has not been fixed in latest Android Q. Just check out

https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/bluetooth/BluetoothGatt.java and see that nothing has changed relating to this.
To reproduce, just call "BluetoothAdapter.getDefaultAdapter().getRemoteDevice("XX:XX:XX:XX:XX:XX").connectGatt(context, true, new BluetoothGattCallback(){}).close();" (after putting in a valid BD address and a Context). See initial description for more details.

I attached a "bug report" from a Pixel 3 phone where the issue was reproduced.

deleted

Restricted

0 B

ra...@google.com <ra...@google.com> Sep 4, 2020 11:11AM

Status: Won't Fix (Obsolete)

em...@gmail.com <em...@gmail.com> #8Sep 4, 2020 11:23AM

Why is this a "Won't Fix (Obsolete)"?
The bug is still present. Just check out

https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/bluetooth/BluetoothGatt.java and see that nothing has changed relating to this.

we...@gmail.com <we...@gmail.com> #9Jul 13, 2024 12:40AM

I’m the maintainer for flutter_blue_plus. We are affected by this issue as well. See:

https://github.com/boskokg/flutter_blue_plus/issues/927