)]}'
{
  "commit": "555cd2bd860e7c4bdc3f4e4405b05515b0d9bc87",
  "tree": "6a77620419e8930b0061034d2bca3a8ae9ddaafc",
  "parents": [
    "2ea5a87a5a7ae58cb2662b8a7d06f209383e1765"
  ],
  "author": {
    "name": "Radek Podgorny",
    "email": "radek@podgorny.cz",
    "time": "Sun Sep 13 22:28:02 2026 +0200"
  },
  "committer": {
    "name": "Luiz Augusto von Dentz",
    "email": "luiz.von.dentz@intel.com",
    "time": "Tue Sep 15 14:55:32 2026 -0400"
  },
  "message": "Bluetooth: keep dst_type with dst when reusing an LE connection\n\nhci_connect_le() swaps the caller\u0027s identity address for the peer\u0027s\ncached RPA when one is known, and stamps the matching\nADDR_LE_DEV_RANDOM on the local dst_type. On the conn-reuse path only\nthe address is copied into the connection:\n\n  if (conn) {\n          bacpy(\u0026conn-\u003edst, dst);\n\nso conn-\u003edst ends up holding an RPA while conn-\u003edst_type still names the\nidentity it was resolved from, and hci_le_create_conn_sync() puts that\npair on air unchanged. An RPA declared as a public address is not\nsomething any peer can answer.\n\nMeasured on a CYW43438 against a peer advertising an RPA the host holds\nthe IRK for, connecting to the identity address over a raw L2CAP socket.\nThe first attempt creates the connection, the second takes the reuse\npath:\n\n  LE Create Connection  3C:78:95:78:37:C3  type public\n  LE Create Connection  5B:75:A2:26:D6:18  type public\n  LE Connection Complete: Unknown Connection Identifier (0x02)\n\nThe second address is the peer\u0027s RPA. btmon annotates it with an OUI\nlookup rather than \"(Resolvable)\" precisely because the command declares\nit public; the same bit pattern annotates as resolvable once the type is\nright.\n\nThe mistyped pair is also why nothing downstream repairs it.\nhci_bdaddr_is_rpa() tests the type before the address, so an RPA carrying\na public type is not recognised as one, and hci_find_irk_by_addr() then\nsearches for an identity address that does not match it either.\n\nCopy the type along with the address.\n\nThe assignment used to be unconditional just below this block and covered\nboth paths; it moved into hci_conn_add_unset(), which the reuse path does\nnot go through.\n\nCc: stable@vger.kernel.org\nFixes: 14b06c3a88f7 (\"Bluetooth: HCI: Always use the identity address when initializing a connection\")\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Radek Podgorny \u003cradek@podgorny.cz\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c9466cb2c7c0083c98d212093dd11b17d7bdc0e9",
      "old_mode": 33188,
      "old_path": "net/bluetooth/hci_conn.c",
      "new_id": "fa72cf8aaa7a0a1b3b999ddedef490dd3f5354c4",
      "new_mode": 33188,
      "new_path": "net/bluetooth/hci_conn.c"
    }
  ]
}