IssueTracker

I’m a developer of an app for Wear OS which utilizes Bluetooth-LE. Since the latest Wear OS update (Wear OS 4.0, One UI 5.0), it started failing for numerous users of mine with Samsung Galaxy Watch 5 models.

I have managed to verify the failure myself. I have also created another minimal app which just attempts to establish a simple Gatt LE connection, which fails.

Both apps run successfully on Galaxy Watch 4, Google Pixel Watch, and other models, but fail on Galaxy Watch 5 models, while running the same software: Wear OS 4.0 and One UI 5.0.

Please see the following GDrive folder: https://drive.google.com/drive/u/0/folders/1zLIBZmnRD2fCAqpXt0BdY0ytmXs1a0A0

It contains:

1. A bug report
2. A short extract of important logs from a Galaxy Watch 5 (contain the bug)
3. A short extract of important logs from a Galaxy Watch 4 (no bug)
4. The minimal example project to reproduce the issue

I'll briefly describe what I'm seeing in the above: My app tries to establish a Gatt connection with bluetoothDevice.connectGatt(context, false, gattCallback, BluetoothDevice.TRANSPORT_LE), but the BluetoothGattCallback is never called.

The bt_stack (com.android.bluetooth) logs show a few key details:

At first, it starts fairly normal:

W  Creating le direct connection to:xx:xx:xx:xx:03:1f[public]
W  AcceptLeConnectionFrom xx:xx:xx:xx:03:1f
W  Allow Le connection from remote:xx:xx:xx:xx:03:1f[PUBLIC_DEVICE_ADDRESS]
W  create_le_connection :: address : a8:22:9f, add_to_connect_list : 1, is_direct : 1
W  add_device_to_connect_list a8:22:9f :: Send command after register

But at some point, it mentions a weird nil address and fails with CONNECTION_ALREADY_EXISTS:

W  No prior connection request for 00:00:00
W  Device not in acceptlist and cannot be removed:00:00[PUBLIC_DEVICE_ADDRESS]
W  le_impl::add() handle=0x42 addr=00:00:00
W  create_le_connection :: address : 00:00:00, add_to_connect_list : 0, is_direct : 0
W  add_to_connect_list is false. call arm_connectability()
W  Unknown device being removed from acceptlist:xx:xx:xx:xx:00:00[PUBLIC_DEVICE_ADDRESS]
W  arm_connectability()
E  Received UNEXPECTED command status:CONNECTION_ALREADY_EXISTS opcode:0x2043 (LE_EXTENDED_CREATE_CONNECTION)
W  on_le_disconnect Handle : 0x42, Reason : 62
W  le_impl::remove() handle=0x42 addr=00:00:00
W  [Current Device list in background_connections_ set]
E  Unable to find sco connection
W  Got uncommon disconnection reason:Connection Failed Establishment handle:0x0042 comment:stack::acl::btm_acl::btm_acl_disconnected
W  Got disconnect for unknown device record handle:0x0042

I have tried whatever I can to get around it, but couldn't find a way. I'm quite certain this is a bug in Wear OS or some driver related to Galaxy Watch 5. The nil address might even hint at some memory corruption which might potentially be a security vulnerability.

Would greatly appreciate your support.

Thank you, Uri