[PATCH] Bluetooth: btmtk: fix error handling in btmtk_usb_isointf_init()

[PATCH] Bluetooth: btmtk: fix error handling in btmtk_usb_isointf_init()

[Ismail Tarim]

btmtk_usb_isointf_init() submits the ISO interrupt IN URB and then
sends the vendor command 0xfd98. If that command fails, the function
returns an error without killing the URB it has just submitted. The
caller then leaves BTMTK_ISOPKT_RUNNING clear, so the driver treats the
ISO path as inactive while its RX URB is still in flight, and
btmtk_usb_suspend() skips killing it. Kill the anchored URBs on this
path, as the URB submission failure path already does.

The return value of __set_mtk_intr_interface() is also ignored: a
failure to select the ISO alternate setting or to find its endpoints
is logged, but the function goes on to submit the URB. Return the
error instead.

Fixes: ceac1cb0259d ("Bluetooth: btusb: mediatek: add ISO data transmission functions")
Signed-off-by: Ismail Tarim <ismailtarim7@gmail.com>
---
Tested on an MT7902 (USB 13d3:3579) with 7.2.11 by forcing the 0xfd98
command to fail once with -ENOMEM through a local test-only module
parameter. Right before the function returns, usb_anchor_empty() on the
ISO anchor reads 0 without this patch and 1 with it; the rest of the
controller setup completes in both cases.

 drivers/bluetooth/btmtk.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 6a48ff0192cf..1b3dab0d10bb 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -1741,7 +1741,9 @@ static int btmtk_usb_isointf_init(struct hci_dev *hdev)
 
 	spin_lock_init(&btmtk_data->isorxlock);
 
-	__set_mtk_intr_interface(hdev);
+	err = __set_mtk_intr_interface(hdev);
+	if (err < 0)
+		return err;
 
 	err = btmtk_submit_intr_urb(hdev, GFP_KERNEL);
 	if (err < 0) {
@@ -1753,6 +1755,7 @@ static int btmtk_usb_isointf_init(struct hci_dev *hdev)
 	skb = __hci_cmd_sync(hdev, 0xfd98, sizeof(iso_param), &iso_param,
 			     HCI_INIT_TIMEOUT);
 	if (IS_ERR(skb)) {
+		usb_kill_anchored_urbs(&btmtk_data->isopkt_anchor);
 		bt_dev_err(hdev, "Failed to apply iso setting (%ld)", PTR_ERR(skb));
 		return PTR_ERR(skb);
 	}
-- 
2.56.0

RE: Bluetooth: btmtk: fix error handling in btmtk_usb_isointf_init()

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1020 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1196677/

---Test result---

Test Summary:
CheckPatch                    PASS      0.65 seconds
VerifyFixes                   PASS      0.08 seconds
VerifySignedoff               PASS      0.08 seconds
GitLint                       PASS      0.26 seconds
SubjectPrefix                 PASS      0.08 seconds
BuildKernel                   PASS      32.74 seconds
CheckAllWarning               PASS      36.93 seconds
CheckSparse                   PASS      39.57 seconds
BuildKernel32                 PASS      32.49 seconds
CheckKernelLLVM               PASS      34.45 seconds
TestRunnerSetup               PASS      756.08 seconds
IncrementalBuild              PASS      30.87 seconds



https://github.com/bluez/bluetooth-next/pull/1026

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: btmtk: fix error handling in btmtk_usb_isointf_init()

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri, 30 Oct 2026 01:40:15 +0300 you wrote:
> btmtk_usb_isointf_init() submits the ISO interrupt IN URB and then
> sends the vendor command 0xfd98. If that command fails, the function
> returns an error without killing the URB it has just submitted. The
> caller then leaves BTMTK_ISOPKT_RUNNING clear, so the driver treats the
> ISO path as inactive while its RX URB is still in flight, and
> btmtk_usb_suspend() skips killing it. Kill the anchored URBs on this
> path, as the URB submission failure path already does.
> 
> [...]

Here is the summary with links:
  - Bluetooth: btmtk: fix error handling in btmtk_usb_isointf_init()
    https://git.kernel.org/bluetooth/bluetooth-next/c/215ef299184d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html