[PATCH] Bluetooth: hci_event: reject incoming conn request when MASTER conn exists

[SeungJu Cheon]

hci_conn_request_evt() reuses an existing connection without checking
its role. When the existing connection has the MASTER role (outgoing
connection in progress), conn->state is incorrectly overwritten from
BT_CONNECTED or BT_OPEN to BT_CONNECT, causing state machine corruption.

This can lead to use-after-free or state confusion when the connection
is later disconnected.

The issue was observed during VHCI testing:

  Thread 1: Local connect() -> conn created (role=MASTER, state=BT_OPEN)
  Thread 2: Remote Connection Request received
         -> hci_conn_hash_lookup_ba() finds existing MASTER conn
         -> conn->state overwritten to BT_CONNECT (no role check!)

Fix by rejecting incoming connection requests when a MASTER connection
to the same address already exists.

Fixes: 70c464256310 ("Bluetooth: Refactor connection request handling")
Signed-off-by: SeungJu Cheon <suunj1331@xxxxxxxxx>
---
 net/bluetooth/hci_event.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 286529d2e554..3d34cf2e5067 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3327,6 +3327,12 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data,
 			bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn));
 			goto unlock;
 		}
+	} else if (conn->role == HCI_ROLE_MASTER) {
+		/* Reject incoming request when outgoing connection to
+		 * the same device is already in progress.
+		 */
+		hci_reject_conn(hdev, &ev->bdaddr);
+		goto unlock;
 	}
 
 	memcpy(conn->dev_class, ev->dev_class, 3);
-- 
2.52.0