Public bug reported: # [SRU request] Backport BlueZ HIDP bonding fix #2034 to Ubuntu 26.04 (Resolute)
## Summary Ubuntu 26.04 LTS currently ships BlueZ 5.85, which is affected by an upstream BlueZ HIDP bonding bug on dual-mode Bluetooth devices. The issue causes an already paired and bonded Bluetooth audio device to connect successfully and then immediately disconnect. The problem has already been fixed upstream: BlueZ issue: https://github.com/bluez/bluez/issues/2034 Upstream fix: https://github.com/bluez/bluez/commit/756da3fa17b9a892ce22bc340b9a293a6c68931f The fix is included in BlueZ 5.87. I successfully backported this exact upstream commit to Ubuntu's BlueZ 5.85 package, and it resolves the problem. ## Environment Ubuntu: 26.04 LTS (Resolute) BlueZ before fix: 5.85-4ubuntu0.1 Kernel: 7.0.0-29-generic Bluetooth controller: Intel BE200 USB ID: 8087:0036 PipeWire: 1.6.2 WirePlumber: 0.5.13 Test device: Redmi Buds 6 Play Bluetooth address: 48:73:CB:F6:45:17 The same connect/disconnect behavior was also observed with a JBL Flip 7. ## Steps to reproduce 1. Pair the Redmi Buds 6 Play normally. 2. Verify that the device is paired, bonded and trusted. 3. Disconnect or power off the device. 4. Attempt to reconnect it. 5. BlueZ initially establishes the connection, but shortly afterwards the device disconnects. The device reports: Paired: yes Bonded: yes Trusted: yes However, bluetoothd logs: profiles/input/device.c:hidp_add_connection() Rejected connection from !bonded device This is followed by errors such as: profiles/audio/avctp.c:avctp_connect_cb() connect to 48:73:CB:F6:45:17: Software caused connection abort (103) src/profile.c:ext_io_disconnected() Unable to get io data for Hands-Free Voice gateway: getpeername: Transport endpoint is not connected (107) No matching connection for device The Bluetooth audio device therefore connects and immediately disconnects. ## Expected result A device which is already correctly paired and bonded over BR/EDR should be accepted by HIDP and remain connected. The Bluetooth audio device should appear normally as a BlueZ/PipeWire audio device and A2DP sink. ## Actual result BlueZ incorrectly rejects the HIDP connection as coming from an unbonded device despite: Paired: yes Bonded: yes Trusted: yes The connection subsequently aborts. ## Root cause This corresponds to upstream BlueZ issue #2034. HIDP is a BR/EDR (Classic Bluetooth) profile, but the affected BlueZ code can check the bonding state using the device's selected address/bearer type instead of explicitly checking the BR/EDR bonding state. For dual-mode devices this can cause an existing BR/EDR bond to be incorrectly treated as unbonded. Upstream commit 756da3fa fixes this by explicitly using BDADDR_BREDR for HIDP bonding operations. The upstream commit modifies two locations in profiles/input/device.c: * input_device_bonded() * virtual_cable_unplug() ## Fix Upstream commit: 756da3fa17b9a892ce22bc340b9a293a6c68931f "input: Fix checking LE bonding on HIDP" The important behavioral change is that HIDP explicitly checks the BR/EDR bond: device_is_bonded(idev->device, BDADDR_BREDR) and removes the BR/EDR bond explicitly when handling Virtual Cable Unplug: device_remove_bonding(idev->device, BDADDR_BREDR) ## Verification I backported the complete upstream commit to the Ubuntu source package: bluez 5.85-4ubuntu0.1 and built a local package: bluez 5.85-4ubuntu0.1+aag20341 No other functional BlueZ changes were intentionally introduced. After installing the patched package and restarting bluetooth.service, the previously failing Redmi Buds 6 Play connects successfully. bluetoothctl now reports: Paired: yes Bonded: yes Trusted: yes Connected: yes PipeWire successfully creates the Bluetooth device: Redmi Buds 6 Play [bluez5] and creates the audio sink/source. Audio playback works normally. Most importantly, the previous error: hidp_add_connection() Rejected connection from !bonded device no longer occurs. The previous connection-abort sequence also no longer occurs during the successful test. ## Additional A/B verification Before applying the upstream patch, temporarily setting: ClassicBondedOnly=false also allowed the affected device to connect successfully. Restoring the default secure behavior caused the problem to return. The permanent upstream patch resolves the problem while retaining the normal ClassicBondedOnly security behavior. ## Regression potential The upstream patch is small and narrowly scoped to HIDP. HIDP is a Classic Bluetooth profile, so explicitly using BDADDR_BREDR matches the transport used by HIDP. The change has already been accepted upstream and released in BlueZ 5.87. The patch does not disable ClassicBondedOnly and therefore avoids using the less secure workaround. Potential regressions should primarily concern HIDP bonding/unbonding behavior, especially dual-mode HID devices. Testing should include both ordinary BR/EDR HID devices and dual-mode BR/EDR + LE devices. ## SRU Test Plan On an affected Ubuntu 26.04 system: 1. Install the proposed BlueZ package. 2. Ensure ClassicBondedOnly remains at its normal/default value. 3. Pair a dual-mode affected device. 4. Disconnect it. 5. Reconnect it several times. 6. Confirm bluetoothctl reports Connected: yes. 7. Confirm no "Rejected connection from !bonded device" message appears in bluetoothd. 8. For Bluetooth audio devices, confirm PipeWire creates a bluez5 device and audio sink. 9. Reboot and repeat the reconnect test. 10. Test suspend/resume followed by reconnection. 11. Verify normal Bluetooth HID devices continue to pair, reconnect and unpair correctly. ## Request Please consider backporting upstream BlueZ commit: 756da3fa17b9a892ce22bc340b9a293a6c68931f to the BlueZ package in Ubuntu 26.04 LTS (Resolute). This would provide the upstream fix without requiring affected Ubuntu users to disable ClassicBondedOnly or maintain locally patched BlueZ packages. ** Affects: bluez (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2163100 Title: [SRU] BlueZ HIDP rejects bonded dual-mode devices as !bonded (upstream #2034) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/bluez/+bug/2163100/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
