Bluetooth: btmtk: MT7925 fails "wmt func ctrl" (-EINVAL) since 634a4408c061

[Bernie Innocenti <bernie@codewiz.org>]

Hi,

Since commit 634a4408c061 ("Bluetooth: btmtk: validate WMT event SKB 
length before struct access") my MediaTek MT7925 Bluetooth adapter no 
longer initializes. The controller never registers and is absent from 
userspace.

I'm seeing this on a Framework 16 (AMD Ryzen AI 9) with a MediaTek 
MT7925 (USB ID 0e8d:0717) running Fedora Rawhide.

Firmware is BT_RAM_CODE_MT7925_1_1_hdr.bin and loads fine in both, so 
this is not a firmware or kconfig issue.

Bad kernel (7.1.0-0.rc3.260515g70eda68668d1.27.fc45.x86_64):

   Bluetooth: hci0: HW/SW Version: 0x00000000, Build Time: 20260106153314
   Bluetooth: hci0: Failed to send wmt func ctrl (-22)
   Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is 
advertised, but not supported.

Good kernel (7.0.0-62.fc45.x86_64):

   Bluetooth: hci0: HW/SW Version: 0x00000000, Build Time: 20260106153314
   Bluetooth: hci0: Device setup in 296567 usecs
   Bluetooth: hci0: AOSP extensions version v1.00


Bug analysis courtesy of Claude Opus, I haven't verified:

   The failure (-22 = -EINVAL) comes from the new length guard in the
   BTMTK_WMT_FUNC_CTRL branch of btmtk_usb_hci_wmt_sync():

     case BTMTK_WMT_FUNC_CTRL:
         if (!skb_pull_data(data->evt_skb, sizeof(wmt_evt_funcc->status))) {
             err = -EINVAL;
             goto err_free_skb;
         }

   The first skb_pull_data() (base 7-byte WMT event) succeeds — neither
   "WMT event too short" nor "Wrong op" is logged — so it is specifically
   this second 2-byte status pull that returns NULL. The MT7925 FUNC_CTRL
   response is shorter than the full 9-byte struct
   btmtk_hci_wmt_evt_funcc the check assumes, so a valid response is now
   rejected. The pre-commit code tolerated this, hence the regression.
   The commit's bounds-check intent is sound, but the trailing status
   field should be treated as optional for devices that return a short
   event, rather than hard failing.

   The commit was isolated by code inspection: it is the only post-7.0
   btmtk change introducing an -EINVAL in this path.

   The commit is Cc: stable, so affected stable trees likely regress too.


Happy to test patches or provide full dmesg / btmon traces.

#regzbot introduced: 634a4408c061

-- 
_ // Bernie Innocenti
\X/  https://codewiz.org/