[Bug 221521] New: Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[Bug 221521] New: Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

            Bug ID: 221521
           Summary: Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl
                    (-22) on MediaTek MT7921 combo adapter
           Product: Drivers
           Version: 2.5
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: blocking
          Priority: P3
         Component: Bluetooth
          Assignee: linux-bluetooth@vger.kernel.org
          Reporter: txxlc@pm.me
        Regression: No

On kernel 7.0.7, the Bluetooth portion of the MediaTek MT7921 PCIe combo
adapter fails to initialize. The btusb driver detects the device (hci0), but
initialization aborts with:
Bluetooth: hci0: Failed to send wmt func ctrl (-22)
As a result, bluetoothd starts successfully but reports no available
controllers. bluetoothctl list returns empty, and GUI managers (blueman,
bluedevil) cannot enable the adapter. RFKill shows no software/hardware blocks.
The Wi-Fi portion (mt7921e) initializes and works correctly.

Steps to Reproduce
    1. Boot system with kernel 7.0.7
    2. Check dmesg | grep -iE 'bluetooth|btusb|mt7921'
    3. Run bluetoothctl list
    4. Observe Failed to send wmt func ctrl (-22) in kernel log and No default
controller available in BlueZ

Relevant logs:
% sudo dmesg | grep -A2 -B2 'wmt func ctrl'
[    6.063435] input: HD-Audio Generic Mic as
/devices/pci0000:00/0000:00:08.1/0000:04:00.6/sound/card1/input16
[    6.063488] input: HD-Audio Generic Headphone as
/devices/pci0000:00/0000:00:08.1/0000:04:00.6/sound/card1/input17
[    6.078123] Bluetooth: hci0: Failed to send wmt func ctrl (-22)
[    6.078129] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection
command is advertised, but not supported.
[    6.133913] mt7921e 0000:03:00.0: HW/SW Version: 0x8a108a10, Build Time:
20260224110909a

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

txxlc@pm.me changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Hardware|All                         |AMD

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

txxlc@pm.me changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Kernel Version|                            |7.0.7

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

--- Comment #1 from txxlc@pm.me ---
Extra info:

Kernel info:
Linux pc 7.0.7-arch1-1.1 #1 SMP PREEMPT_DYNAMIC Fri, 15 May 2026 00:50:13 +0000
x86_64 GNU/Linux

Hardware:
% lspci -nn | grep -i '03:00.0\|mt7921'
03:00.0 Network controller [0280]: MEDIATEK Corp. MT7921 802.11ax PCIe Wireless
Network Adapter [Filogic 330] [14c3:7961]

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

txxlc@pm.me changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|blocking                    |normal

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Piotr Beśka (abuson2@gmail.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |abuson2@gmail.com

--- Comment #2 from Piotr Beśka (abuson2@gmail.com) ---
I can confirm the same regression on a MediaTek MT7925 PCIe Wi-Fi/Bluetooth
combo adapter.

Working:

* Linux 7.0.6-200.fc44.x86_64

Broken:

* Linux 7.0.7-200.fc44.x86_64

Firmware is unchanged between both tests:

* linux-firmware-20260410-1.fc44.noarch
* mt7xxx-firmware-20260410-1.fc44.noarch

Symptoms match this report:

* Wi-Fi works
* bluetoothd starts
* rfkill shows hci0, not blocked
* bluetoothctl reports: No default controller available

dmesg:
Bluetooth: hci0: Failed to send wmt func ctrl (-22)


Booting back into 7.0.6 immediately restores Bluetooth. A full power cut does
not fix Bluetooth on 7.0.7.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

jill+kernel@kokakiwi.net changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jill+kernel@kokakiwi.net

--- Comment #3 from jill+kernel@kokakiwi.net ---
Confirming this regression on MediaTek MT7922 (`0e8d:0717`) on Arch Linux.

Broken: `7.0.7-zen2-1` (linux-zen) and `6.18.30-1-lts` (linux-lts)
Working: `7.0.6-zen1-1` (linux-zen)

Same symptom: `Bluetooth: hci0: Failed to send wmt func ctrl (-22)` immediately
at boot, Wi-Fi unaffected.

The regression field should be set to "Yes". Based on the 7.0.7 changelog, the
likely culprit is commit `634a4408c061` ("Bluetooth: btmtk: validate WMT event
SKB length before struct access"), which introduced `skb_pull_data()` length
validation in `btmtk_usb_hci_wmt_sync()`. The MT7922 appears to send a WMT
response that the new validation rejects as too short, causing `-EINVAL` before
the chip is ever enabled.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

txxlc@pm.me changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Bisected commit-id|                            |634a4408c061
         Regression|No                          |Yes

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |erpumper@gmail.com

--- Comment #4 from Artem S. Tashkinov (aros@gmx.com) ---
*** Bug 221511 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Bisected commit-id|634a4408c061                |634a4408c0615c523cf7531790f
                   |                            |4f14a422b9206
             Status|NEW                         |RESOLVED
                URL|                            |https://lore.kernel.org/all
                   |                            |/5i35wmc4z7sz54jo5uj6ywext2
                   |                            |enh4ik3oxmfmperqk2v5kc27@pp
                   |                            |vm6oodzipn/
         Resolution|---                         |CODE_FIX

--- Comment #5 from Artem S. Tashkinov (aros@gmx.com) ---
This commit should fix it:

https://lore.kernel.org/all/770d36b07311bf88210c187923f243fb9f126f04.1777058551.git.pav@iki.fi/

Not yet pushed to stable but hopefully will be there in time for 7.0.8.

Keep an eye on
https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-7.0

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |flavio.caetano@gmail.com

--- Comment #6 from Artem S. Tashkinov (aros@gmx.com) ---
*** Bug 221525 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

--- Comment #7 from erpumper@gmail.com ---
Hello I say kernel 7.1 rc error panel

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |autofire372@gmail.com

--- Comment #8 from Artem S. Tashkinov (aros@gmx.com) ---
*** Bug 221529 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.