IssueTracker

When initiating Bluetooth Low Energy connections using the "direct connect" mode (setting the autoConnect parameter to false when creating the gatt object), Android does not use the white list but rather only tries to connect to this particular device with a 30 second long timeout.

If there already is a pending direct connect attempt and you try to establish another connection using the "direct connect" this request cannot start directly but the attempt to connect will start when the previous one has either connected successfully or the timeout has triggered or it is aborted. (They are basically queued up.)

However, there is a bug if you try to abort a pending direct connect that has not yet started but is still waiting in the queue. What happens is that as far as the app sees, the attempt is successfully aborted. However it's not really aborted. Once the previous request has finished it will start attempting to connect to the peripheral. If the peripheral connects, it remains connected to the Android device but can't be accessed anymore until either the peripheral disconnects or Bluetooth is restarted (app restart doesn't work). If you try to establish a new direct connect gatt connection to that device you immediately get an onConnectionStateChange callback with status GATT_ERROR (133). If you try to establish an auto connect gatt connection to that device no onConnectionStateChange is called at all (until the peripheral for some reason disconnects and reconnects).

Affected Android versions: Basically all I've tested on (Kitkat up to Nougat) for one exception. I've tested on Nexus 5, LG G3 Nexus 5X.

Samsung Note 4 (Android 4.4.2)
Samsung S5 (Android 6.0)
HTC One (Android 4.4.2)
LG G3 (Android 6.0 build MRA58K)
Nexus 5 (Android 6.0.1 build MOB30Y)
Nexus 6 (Android 7.0 build NPD90G)
Nexus 5X (Android 7.0 build NRD90S)
Nexus 5X (Android 7.0 build NPF26F developer preview)
Sony Xperia Z3 (Android 7.0 Preview)
Oppo X9009 (ColorOS V3.0.0i based on Android 5.1)

Devices where the bug is not triggered:
Xiaomi Redmi Note 3 (Android 5.x) (Maybe Mediatek has implemented some fix not merged into master?)


Steps to reproduce:
1. Have two BLE peripherals (device 1 and device 2). Turn them off so they don't advertise.
2. connectGatt with autoConnect=false to device 1.
(You sometimes may have to wait a bit between step 2 and 3 so the two operations are not reordered).
3. connectGatt with autoConnect=false to device 2.
4. Wait some time due to https://code.google.com/p/android/issues/detail?id=223582.
5. Call disconnect() on the second gatt object (or close() if you are not affected by https://code.google.com/p/android/issues/detail?id=223716).
6. Let device 1 start advertise so it becomes connected OR wait 30 seconds OR call disconnect() on the first gatt object.
7. Let device 2 start advertise.

Expected outcome:
Device 2 should NOT get connected.

What happens instead:
Device 2 becomes connected to the Android device. As written above, it's impossible to use this connection from Android.

Frequency: 100%

I think the whole thing about queuing up direct connects seems like a very bad idea, I don't actually see the reason at all for doing so. Why not just use the white list instead so that there can be multiple pending connections at once? Then the only difference between "direct connect" and "auto connect" would be that direct connect uses more active scan parameters and has the timeout of 30 seconds.

Example code to reproduce:
BluetoothGatt gatt0 = BluetoothAdapter.getDefaultAdapter().getRemoteDevice("80:E4:DA:70:54:14").connectGatt(this, false, cb3);
sleep(100);
BluetoothGatt gatt1 = BluetoothAdapter.getDefaultAdapter().getRemoteDevice("80:E4:DA:70:B2:30").connectGatt(this, false, cb1);
sleep(2000);
gatt1.disconnect();
sleep(100);
gatt0.disconnect();

Logcat (from Nexus 5X NPF26F, corresponding to the same HCI snooplog session):
11-25 15:43:55.680 16191 16191 D BluetoothGatt: connect() - device: 80:E4:DA:70:54:14, auto: false
11-25 15:43:55.680 16191 16191 D BluetoothGatt: registerApp()
11-25 15:43:55.680 16191 16191 D BluetoothGatt: registerApp() - UUID=9a0ba22a-592a-4e05-b1a0-c3fc8bbaa814
11-25 15:43:55.681 15744 15756 D BtGatt.GattService: registerClient() - UUID=9a0ba22a-592a-4e05-b1a0-c3fc8bbaa814
11-25 15:43:55.682 15744 15763 D BtGatt.GattService: onClientRegistered() - UUID=9a0ba22a-592a-4e05-b1a0-c3fc8bbaa814, clientIf=5
11-25 15:43:55.682 16191 16206 D BluetoothGatt: onClientRegistered() - status=0 clientIf=5
11-25 15:43:55.683 15744 15805 D BtGatt.GattService: clientConnect() - address=80:E4:DA:70:54:14, isDirect=true
11-25 15:43:55.683 15744 15763 D bt_btif_config: btif_get_address_type: Device [80:e4:da:70:54:14] address type 0
11-25 15:43:55.683 15744 15763 D bt_btif_config: btif_get_device_type: Device [80:e4:da:70:54:14] type 2
11-25 15:43:55.782 16191 16191 D BluetoothGatt: connect() - device: 80:E4:DA:70:B2:30, auto: false
11-25 15:43:55.782 16191 16191 D BluetoothGatt: registerApp()
11-25 15:43:55.783 16191 16191 D BluetoothGatt: registerApp() - UUID=c52b5b5e-dadb-4099-a0c6-fc53d72eb463
11-25 15:43:55.784 15744 15765 D BtGatt.GattService: registerClient() - UUID=c52b5b5e-dadb-4099-a0c6-fc53d72eb463
11-25 15:43:55.784 15744 15763 D BtGatt.GattService: onClientRegistered() - UUID=c52b5b5e-dadb-4099-a0c6-fc53d72eb463, clientIf=6
11-25 15:43:55.785 16191 16205 D BluetoothGatt: onClientRegistered() - status=0 clientIf=6
11-25 15:43:55.785 15744 15807 D BtGatt.GattService: clientConnect() - address=80:E4:DA:70:B2:30, isDirect=true
11-25 15:43:55.786 15744 15763 D bt_btif_config: btif_get_address_type: Device [80:e4:da:70:b2:30] address type 0
11-25 15:43:55.786 15744 15763 D bt_btif_config: btif_get_device_type: Device [80:e4:da:70:b2:30] type 2
11-25 15:43:55.786 15744 15786 W bt_l2cap: L2CAP - LE - cannot start new connection at conn st: 1
11-25 15:43:57.784 16191 16191 D BluetoothGatt: cancelOpen() - device: 80:E4:DA:70:B2:30
11-25 15:43:57.786 15744 15766 D BtGatt.GattService: clientDisconnect() - address=80:E4:DA:70:B2:30, connId=null
11-25 15:43:57.790 15744 15786 W bt_l2cap: L2CA_CancelBleConnectReq - different  BDA Connecting: 80e4da705414  Cancel: 80e4da70b230
11-25 15:43:57.795 15744 15786 E bt_btif : bta_gattc_mark_bg_conn unable to find the bg connection mask for: 80:e4:da:70:b2:30
11-25 15:43:57.890 16191 16191 D BluetoothGatt: cancelOpen() - device: 80:E4:DA:70:54:14
11-25 15:43:57.892 15744 15755 D BtGatt.GattService: clientDisconnect() - address=80:E4:DA:70:54:14, connId=null
11-25 15:43:57.896 15744 15786 W bt_btif : bta_gattc_conn_cback() - cif=3 connected=0 conn_id=3 reason=0x0100
11-25 15:43:57.896 15744 15786 W bt_btif : bta_gattc_conn_cback() - cif=4 connected=0 conn_id=4 reason=0x0100
11-25 15:43:57.896 15744 15786 W bt_btif : bta_gattc_conn_cback() - cif=5 connected=0 conn_id=5 reason=0x0100
11-25 15:43:57.896 15744 15786 W bt_btif : bta_gattc_conn_cback() - cif=6 connected=0 conn_id=6 reason=0x0100
11-25 15:43:57.896 15744 15786 E bt_btif : bta_gattc_mark_bg_conn unable to find the bg connection mask for: 80:e4:da:70:54:14
11-25 15:44:10.610 15744 15786 W bt_btif : bta_dm_acl_change info: 0x0
11-25 15:44:10.610 15744 15763 D bt_btif_dm: remote version info [80:e4:da:70:b2:30]: 0, 0, 0
11-25 15:44:10.632 15744 15763 E BluetoothRemoteDevices: state12newState0
11-25 15:44:10.667  4494  4494 I TrustAgent.Tracker: [BluetoothConnectionTracker] Bluetooth connect broadast for f022cLIw 80:E4:DA:70:B2:30