Re: [bug report] Bluetooth: btusb: Add support for Qualcomm multi-subsystem QCC2072

[Dan Carpenter <error27@gmail.com>]

On Sat, Sep 19, 2026 at 10:36:37AM +0800, Zijun Hu wrote:
> On 9/18/2026 3:17 AM, Dan Carpenter wrote:
> > See also:
> > 
> > drivers/bluetooth/btusb_qcom.c:2931 btusb_qcom_shutdown_unified() warn: passing positive error code '(-4095)-(-62),(-60)-(-1),1-255' to 'ERR_PTR'
> > drivers/bluetooth/btusb_qcom.c:2947 btusb_qcom_shutdown_unified() warn: passing positive error code '(-4095)-(-62),(-60)-(-1),1-255' to 'ERR_PTR'
> > drivers/bluetooth/btusb_qcom.c:3562 btusb_post_download_unified_bt() warn: passing positive error code '(-4095)-(-62),(-60)-(-1),1-255' to 'ERR_PTR'
> > drivers/bluetooth/btusb_qcom.c:3977 btusb_qcom_setup_unified() warn: passing positive error code '(-4095)-(-62),(-60)-(-1),1-255' to 'ERR_PTR'
> 
> Thanks for the report.
> 
> But All reported cases are false positives: __hci_reset_sync() always returns
> 0 or a negative errno, *never* a positive value.

The return values come from here.

net/bluetooth/hci_sync.c
   256  int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen,
   257                               const void *param, u8 event, u32 timeout,
   258                               struct sock *sk)
   259  {
   260          struct sk_buff *skb;
   261          u8 status;
   262  
   263          skb = __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout, sk);
   264  
   265          /* If command return a status event, skb will be set to -ENODATA */
   266          if (skb == ERR_PTR(-ENODATA))
   267                  return 0;
                        ^^^^^^^^

Zero, sure.

   268  
   269          if (IS_ERR(skb)) {
   270                  if (!event)
   271                          bt_dev_err(hdev, "Opcode 0x%4.4x failed: %ld", opcode,
   272                                     PTR_ERR(skb));
   273                  return PTR_ERR(skb);
                        ^^^^^^^^^^^^^^^^^^^
Error pointer.  Fine.

   274          }
   275  
   276          status = skb->data[0];
   277  
   278          kfree_skb(skb);
   279  
   280          return status;
                ^^^^^^^^^^^^^
But this seems like it could be a positive...

   281  }

regards,
dan carpenter