Linux 7.1-rc3 regression (Bluetooth)

Linux 7.1-rc3 regression (Bluetooth)

[markus.suvanto]

Hello

I upgrade 7.1-rc2 to 7.1-rc3. After that bluetooth  didn't start
hci0: Failed to send wmt func ctrl (-22)
My fix was to revert commit 634a4408c0615c523cf7531790f4f14a422b9206

-Markus Suvanto


commit 994246ea1eed9029d648b28a9828359f5046173e (HEAD -> master)
Author: Markus Suvanto <markus.suvanto@movesole.com>
Date:   Mon May 11 07:29:47 2026 +0300

    Revert "Bluetooth: btmtk: validate WMT event SKB length before struct access"
    
    This reverts commit 634a4408c0615c523cf7531790f4f14a422b9206.

commit 5d6919055dec134de3c40167a490f33c74c12581 (tag: v7.1-rc3, origin/master, origin/HEAD)
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun May 10 14:08:09 2026 -0700

    Linux 7.1-rc3


Lenovo ThinkPad T14s Gen 1 (20UJ) AMD Ryzen 5 PRO 4650U 

Not working dmesg:
masu@t470 ~ % grep Bluetoot dmesg_7.1.0-rc3 
[    4.229749] Bluetooth: Core ver 2.22
[    4.232923] Bluetooth: HCI device and connection manager initialized
[    4.233081] Bluetooth: HCI socket layer initialized
[    4.233227] Bluetooth: L2CAP socket layer initialized
[    4.233236] Bluetooth: SCO socket layer initialized
[    4.413060] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20251223091725
[    6.142372] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[    6.142384] Bluetooth: BNEP filters: protocol multicast
[    6.142393] Bluetooth: BNEP socket layer initialized
[    7.727087] Bluetooth: hci0: Failed to send wmt func ctrl (-22)
[    7.727140] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.


Working dmesg:
masu@t470 ~ % grep Bluetoot dmesg_7.1.0-rc3-00001-g994246ea1eed  
[    4.296358] Bluetooth: Core ver 2.22
[    4.296385] Bluetooth: HCI device and connection manager initialized
[    4.296393] Bluetooth: HCI socket layer initialized
[    4.296399] Bluetooth: L2CAP socket layer initialized
[    4.296404] Bluetooth: SCO socket layer initialized
[    4.391514] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20251223091725
[    6.087152] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[    6.087165] Bluetooth: BNEP filters: protocol multicast
[    6.087172] Bluetooth: BNEP socket layer initialized
[    7.591891] Bluetooth: hci0: Device setup in 3127955 usecs
[    7.591922] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
[    7.657339] Bluetooth: MGMT ver 1.23
[   25.883135] Bluetooth: RFCOMM TTY layer initialized
[   25.883150] Bluetooth: RFCOMM socket layer initialized
[   25.883154] Bluetooth: RFCOMM ver 1.11

Re: Linux 7.1-rc3 regression (Bluetooth)

[Thorsten Leemhuis]

On 5/11/26 07:17, markus.suvanto@gmail.com wrote:
> Hello
> 
> I upgrade 7.1-rc2 to 7.1-rc3. After that bluetooth  didn't start
> hci0: Failed to send wmt func ctrl (-22)
> My fix was to revert commit 634a4408c0615c523cf7531790f4f14a422b9206

Thx for your report. FWIW, there are two proposed fixed for this change
floating around:

https://lore.kernel.org/all/20260508173121.27526-1-mikhail.v.gavrilov@gmail.com/
https://lore.kernel.org/all/770d36b07311bf88210c187923f243fb9f126f04.1777058551.git.pav@iki.fi/

Given that this is the third revert within a short time-frame I wonder
if we should fast-track a fix (once ready) to spare more users the pain
of bisecting & reporting.

Ciao, Thorsten

> -Markus Suvanto
> 
> 
> commit 994246ea1eed9029d648b28a9828359f5046173e (HEAD -> master)
> Author: Markus Suvanto <markus.suvanto@movesole.com>
> Date:   Mon May 11 07:29:47 2026 +0300
> 
>     Revert "Bluetooth: btmtk: validate WMT event SKB length before struct access"
>     
>     This reverts commit 634a4408c0615c523cf7531790f4f14a422b9206.
> 
> commit 5d6919055dec134de3c40167a490f33c74c12581 (tag: v7.1-rc3, origin/master, origin/HEAD)
> Author: Linus Torvalds <torvalds@linux-foundation.org>
> Date:   Sun May 10 14:08:09 2026 -0700
> 
>     Linux 7.1-rc3
> 
> 
> Lenovo ThinkPad T14s Gen 1 (20UJ) AMD Ryzen 5 PRO 4650U 
> 
> Not working dmesg:
> masu@t470 ~ % grep Bluetoot dmesg_7.1.0-rc3 
> [    4.229749] Bluetooth: Core ver 2.22
> [    4.232923] Bluetooth: HCI device and connection manager initialized
> [    4.233081] Bluetooth: HCI socket layer initialized
> [    4.233227] Bluetooth: L2CAP socket layer initialized
> [    4.233236] Bluetooth: SCO socket layer initialized
> [    4.413060] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20251223091725
> [    6.142372] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
> [    6.142384] Bluetooth: BNEP filters: protocol multicast
> [    6.142393] Bluetooth: BNEP socket layer initialized
> [    7.727087] Bluetooth: hci0: Failed to send wmt func ctrl (-22)
> [    7.727140] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
> 
> 
> Working dmesg:
> masu@t470 ~ % grep Bluetoot dmesg_7.1.0-rc3-00001-g994246ea1eed  
> [    4.296358] Bluetooth: Core ver 2.22
> [    4.296385] Bluetooth: HCI device and connection manager initialized
> [    4.296393] Bluetooth: HCI socket layer initialized
> [    4.296399] Bluetooth: L2CAP socket layer initialized
> [    4.296404] Bluetooth: SCO socket layer initialized
> [    4.391514] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20251223091725
> [    6.087152] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
> [    6.087165] Bluetooth: BNEP filters: protocol multicast
> [    6.087172] Bluetooth: BNEP socket layer initialized
> [    7.591891] Bluetooth: hci0: Device setup in 3127955 usecs
> [    7.591922] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
> [    7.657339] Bluetooth: MGMT ver 1.23
> [   25.883135] Bluetooth: RFCOMM TTY layer initialized
> [   25.883150] Bluetooth: RFCOMM socket layer initialized
> [   25.883154] Bluetooth: RFCOMM ver 1.11

Re: Linux 7.1-rc3 regression (Bluetooth)

[August Wikerfors]

On 2026-05-11 08:30, Thorsten Leemhuis wrote:
> On 5/11/26 07:17, markus.suvanto@gmail.com wrote:
>> Hello
>>
>> I upgrade 7.1-rc2 to 7.1-rc3. After that bluetooth  didn't start
>> hci0: Failed to send wmt func ctrl (-22)
>> My fix was to revert commit 634a4408c0615c523cf7531790f4f14a422b9206
> 
> Thx for your report. FWIW, there are two proposed fixed for this change
> floating around:
> 
> https://lore.kernel.org/all/20260508173121.27526-1-mikhail.v.gavrilov@gmail.com/
> https://lore.kernel.org/all/770d36b07311bf88210c187923f243fb9f126f04.1777058551.git.pav@iki.fi/
> 
> Given that this is the third revert within a short time-frame I wonder
> if we should fast-track a fix (once ready) to spare more users the pain
> of bisecting & reporting.

FYI the commit that caused this regression was backported to the latest
stable releases (6.12.88, 6.18.30 and 7.0.7). I encountered it after
updating to 7.0.7 and can confirm that the patch from the second link
fixes it. That patch is now in the bluetooth tree as e3ac0d9f1a20
("Bluetooth: btmtk: accept too short WMT FUNC_CTRL events") and a pull
request [1] has been made to the net tree. Unfortunately this seems to
have been a few hours too late to make it into the net pull request for
7.1-rc4 [2], so the fix might not get into mainline until next week.

As a side note, it is unfortunate that there does not seem to be a
process to prevent patches that are known to cause regressions from
being backported to stable releases. As far as I can tell, this was
added to regzbot tracking [3] a day before the culprit was queued for
stable [4], so such a process could have prevented this regression in
stable releases.

[1] https://lore.kernel.org/all/20260514172340.1515042-1-luiz.dentz@gmail.com/
[2] https://lore.kernel.org/all/20260514142703.267609-1-pabeni@redhat.com/
[3] https://lore.kernel.org/all/8a17737e-ba9b-4842-a429-c4eab3abcdec@leemhuis.info/
[4] https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/commit/?id=7780f283d14c8c6bf40fe9262219ad821a5dae80

Regards,
August Wikerfors

Re: Linux 7.1-rc3 regression (Bluetooth)

[Greg KH]

On Fri, May 15, 2026 at 04:26:38AM +0200, August Wikerfors wrote:
> On 2026-05-11 08:30, Thorsten Leemhuis wrote:
> > On 5/11/26 07:17, markus.suvanto@gmail.com wrote:
> > > Hello
> > > 
> > > I upgrade 7.1-rc2 to 7.1-rc3. After that bluetooth  didn't start
> > > hci0: Failed to send wmt func ctrl (-22)
> > > My fix was to revert commit 634a4408c0615c523cf7531790f4f14a422b9206
> > 
> > Thx for your report. FWIW, there are two proposed fixed for this change
> > floating around:
> > 
> > https://lore.kernel.org/all/20260508173121.27526-1-mikhail.v.gavrilov@gmail.com/
> > https://lore.kernel.org/all/770d36b07311bf88210c187923f243fb9f126f04.1777058551.git.pav@iki.fi/
> > 
> > Given that this is the third revert within a short time-frame I wonder
> > if we should fast-track a fix (once ready) to spare more users the pain
> > of bisecting & reporting.
> 
> FYI the commit that caused this regression was backported to the latest
> stable releases (6.12.88, 6.18.30 and 7.0.7). I encountered it after
> updating to 7.0.7 and can confirm that the patch from the second link
> fixes it. That patch is now in the bluetooth tree as e3ac0d9f1a20
> ("Bluetooth: btmtk: accept too short WMT FUNC_CTRL events") and a pull
> request [1] has been made to the net tree. Unfortunately this seems to
> have been a few hours too late to make it into the net pull request for
> 7.1-rc4 [2], so the fix might not get into mainline until next week.
> 
> As a side note, it is unfortunate that there does not seem to be a
> process to prevent patches that are known to cause regressions from
> being backported to stable releases. As far as I can tell, this was
> added to regzbot tracking [3] a day before the culprit was queued for
> stable [4], so such a process could have prevented this regression in
> stable releases.

You can email stable@vger to let us know to drop a patch, or when the
-rcs are released, respond to the offending patch in that list.  THat's
why we have -rc releases!

thanks,

greg k-h

Re: Linux 7.1-rc3 regression (Bluetooth)

[johannes.goede]

Hi,

On 15-May-26 07:37, Greg KH wrote:
> On Fri, May 15, 2026 at 04:26:38AM +0200, August Wikerfors wrote:
>> On 2026-05-11 08:30, Thorsten Leemhuis wrote:
>>> On 5/11/26 07:17, markus.suvanto@gmail.com wrote:
>>>> Hello
>>>>
>>>> I upgrade 7.1-rc2 to 7.1-rc3. After that bluetooth  didn't start
>>>> hci0: Failed to send wmt func ctrl (-22)
>>>> My fix was to revert commit 634a4408c0615c523cf7531790f4f14a422b9206
>>>
>>> Thx for your report. FWIW, there are two proposed fixed for this change
>>> floating around:
>>>
>>> https://lore.kernel.org/all/20260508173121.27526-1-mikhail.v.gavrilov@gmail.com/
>>> https://lore.kernel.org/all/770d36b07311bf88210c187923f243fb9f126f04.1777058551.git.pav@iki.fi/
>>>
>>> Given that this is the third revert within a short time-frame I wonder
>>> if we should fast-track a fix (once ready) to spare more users the pain
>>> of bisecting & reporting.
>>
>> FYI the commit that caused this regression was backported to the latest
>> stable releases (6.12.88, 6.18.30 and 7.0.7). I encountered it after
>> updating to 7.0.7 and can confirm that the patch from the second link
>> fixes it. That patch is now in the bluetooth tree as e3ac0d9f1a20
>> ("Bluetooth: btmtk: accept too short WMT FUNC_CTRL events") and a pull
>> request [1] has been made to the net tree. Unfortunately this seems to
>> have been a few hours too late to make it into the net pull request for
>> 7.1-rc4 [2], so the fix might not get into mainline until next week.
>>
>> As a side note, it is unfortunate that there does not seem to be a
>> process to prevent patches that are known to cause regressions from
>> being backported to stable releases. As far as I can tell, this was
>> added to regzbot tracking [3] a day before the culprit was queued for
>> stable [4], so such a process could have prevented this regression in
>> stable releases.
> 
> You can email stable@vger to let us know to drop a patch, or when the
> -rcs are released, respond to the offending patch in that list.  THat's
> why we have -rc releases!

That relies on someone actively intervening in the process though,
I wonder if it would be an idea to have some CI which checks patches
in stable RC releases vs regzbot tracking?

This assumes tegzbot tracking includes the mainline git hash of
commits causing the regression (if/once known).

Regards,

Hans

Re: Linux 7.1-rc3 regression (Bluetooth)

[Thorsten Leemhuis]

On 5/15/26 09:43, johannes.goede@oss.qualcomm.com wrote:
> On 15-May-26 07:37, Greg KH wrote:
>> On Fri, May 15, 2026 at 04:26:38AM +0200, August Wikerfors wrote:
>>> On 2026-05-11 08:30, Thorsten Leemhuis wrote:
>>>> On 5/11/26 07:17, markus.suvanto@gmail.com wrote:
>>>>> I upgrade 7.1-rc2 to 7.1-rc3. After that bluetooth  didn't start
>>>>> hci0: Failed to send wmt func ctrl (-22)
>>>>> My fix was to revert commit 634a4408c0615c523cf7531790f4f14a422b9206
>>>> Thx for your report. FWIW, there are two proposed fixed for this change
>>>> floating around:
>>>> https://lore.kernel.org/all/20260508173121.27526-1-mikhail.v.gavrilov@gmail.com/
>>>> https://lore.kernel.org/all/770d36b07311bf88210c187923f243fb9f126f04.1777058551.git.pav@iki.fi/
>>> [...]
>>> FYI the commit that caused this regression was backported to the latest
>>> stable releases (6.12.88, 6.18.30 and 7.0.7). I encountered it after
>>> [...]
>>> As a side note, it is unfortunate that there does not seem to be a
>>> process to prevent patches that are known to cause regressions from
>>> being backported to stable releases. As far as I can tell, this was
>>> added to regzbot tracking [3] a day before the culprit was queued for
>>> stable [4], so such a process could have prevented this regression in
>>> stable releases.
>> You can email stable@vger to let us know to drop a patch, or when the
>> -rcs are released, respond to the offending patch in that list.  THat's
>> why we have -rc releases!
> 
> That relies on someone actively intervening in the process though,
> I wonder if it would be an idea to have some CI which checks patches
> in stable RC releases vs regzbot tracking?
> 
> This assumes tegzbot tracking includes the mainline git hash of
> commits causing the regression (if/once known).
This is the case. And the idea to let regzbot help with preventing what
happened here is not new and even written on a todo list. The rough plan
was to let regzbot just export the list of mainline commit-ids with
unresolved regressions (together with a link to regzbot's webui with
more details) -- then all Greg would need to do is something like "curl
example.org/unresoved_regressions.txt | grep 1f2e3d4c5b6a" in his apply
script to notice potential problems.

That was how I envisioned things might be good for Greg -- of course
before implementing that I would have talked to him about it. But
regzbot development stalled for about two years due to lack of funding;
we are currently ramping it up again[1], but it will take some time to
get things sorted, so this is likely not something we'll implement
tomorrow. :-(

[1]
https://kernelci.org/blog/2026/05/04/regzbot-joins-kernelci-strengthening-linux-kernel-regression-tracking/

Ciao, Thorsten