Linux 7.1-rc3 regression (Bluetooth)

Linux 7.1-rc3 regression (Bluetooth)

[markus.suvanto]

Hello

I upgrade 7.1-rc2 to 7.1-rc3. After that bluetooth  didn't start
hci0: Failed to send wmt func ctrl (-22)
My fix was to revert commit 634a4408c0615c523cf7531790f4f14a422b9206

-Markus Suvanto


commit 994246ea1eed9029d648b28a9828359f5046173e (HEAD -> master)
Author: Markus Suvanto <markus.suvanto@movesole.com>
Date:   Mon May 11 07:29:47 2026 +0300

    Revert "Bluetooth: btmtk: validate WMT event SKB length before struct access"
    
    This reverts commit 634a4408c0615c523cf7531790f4f14a422b9206.

commit 5d6919055dec134de3c40167a490f33c74c12581 (tag: v7.1-rc3, origin/master, origin/HEAD)
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun May 10 14:08:09 2026 -0700

    Linux 7.1-rc3


Lenovo ThinkPad T14s Gen 1 (20UJ) AMD Ryzen 5 PRO 4650U 

Not working dmesg:
masu@t470 ~ % grep Bluetoot dmesg_7.1.0-rc3 
[    4.229749] Bluetooth: Core ver 2.22
[    4.232923] Bluetooth: HCI device and connection manager initialized
[    4.233081] Bluetooth: HCI socket layer initialized
[    4.233227] Bluetooth: L2CAP socket layer initialized
[    4.233236] Bluetooth: SCO socket layer initialized
[    4.413060] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20251223091725
[    6.142372] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[    6.142384] Bluetooth: BNEP filters: protocol multicast
[    6.142393] Bluetooth: BNEP socket layer initialized
[    7.727087] Bluetooth: hci0: Failed to send wmt func ctrl (-22)
[    7.727140] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.


Working dmesg:
masu@t470 ~ % grep Bluetoot dmesg_7.1.0-rc3-00001-g994246ea1eed  
[    4.296358] Bluetooth: Core ver 2.22
[    4.296385] Bluetooth: HCI device and connection manager initialized
[    4.296393] Bluetooth: HCI socket layer initialized
[    4.296399] Bluetooth: L2CAP socket layer initialized
[    4.296404] Bluetooth: SCO socket layer initialized
[    4.391514] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20251223091725
[    6.087152] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[    6.087165] Bluetooth: BNEP filters: protocol multicast
[    6.087172] Bluetooth: BNEP socket layer initialized
[    7.591891] Bluetooth: hci0: Device setup in 3127955 usecs
[    7.591922] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
[    7.657339] Bluetooth: MGMT ver 1.23
[   25.883135] Bluetooth: RFCOMM TTY layer initialized
[   25.883150] Bluetooth: RFCOMM socket layer initialized
[   25.883154] Bluetooth: RFCOMM ver 1.11

Re: Linux 7.1-rc3 regression (Bluetooth)

[Thorsten Leemhuis]

On 5/11/26 07:17, markus.suvanto@gmail.com wrote:
> Hello
> 
> I upgrade 7.1-rc2 to 7.1-rc3. After that bluetooth  didn't start
> hci0: Failed to send wmt func ctrl (-22)
> My fix was to revert commit 634a4408c0615c523cf7531790f4f14a422b9206

Thx for your report. FWIW, there are two proposed fixed for this change
floating around:

https://lore.kernel.org/all/20260508173121.27526-1-mikhail.v.gavrilov@gmail.com/
https://lore.kernel.org/all/770d36b07311bf88210c187923f243fb9f126f04.1777058551.git.pav@iki.fi/

Given that this is the third revert within a short time-frame I wonder
if we should fast-track a fix (once ready) to spare more users the pain
of bisecting & reporting.

Ciao, Thorsten

> -Markus Suvanto
> 
> 
> commit 994246ea1eed9029d648b28a9828359f5046173e (HEAD -> master)
> Author: Markus Suvanto <markus.suvanto@movesole.com>
> Date:   Mon May 11 07:29:47 2026 +0300
> 
>     Revert "Bluetooth: btmtk: validate WMT event SKB length before struct access"
>     
>     This reverts commit 634a4408c0615c523cf7531790f4f14a422b9206.
> 
> commit 5d6919055dec134de3c40167a490f33c74c12581 (tag: v7.1-rc3, origin/master, origin/HEAD)
> Author: Linus Torvalds <torvalds@linux-foundation.org>
> Date:   Sun May 10 14:08:09 2026 -0700
> 
>     Linux 7.1-rc3
> 
> 
> Lenovo ThinkPad T14s Gen 1 (20UJ) AMD Ryzen 5 PRO 4650U 
> 
> Not working dmesg:
> masu@t470 ~ % grep Bluetoot dmesg_7.1.0-rc3 
> [    4.229749] Bluetooth: Core ver 2.22
> [    4.232923] Bluetooth: HCI device and connection manager initialized
> [    4.233081] Bluetooth: HCI socket layer initialized
> [    4.233227] Bluetooth: L2CAP socket layer initialized
> [    4.233236] Bluetooth: SCO socket layer initialized
> [    4.413060] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20251223091725
> [    6.142372] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
> [    6.142384] Bluetooth: BNEP filters: protocol multicast
> [    6.142393] Bluetooth: BNEP socket layer initialized
> [    7.727087] Bluetooth: hci0: Failed to send wmt func ctrl (-22)
> [    7.727140] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
> 
> 
> Working dmesg:
> masu@t470 ~ % grep Bluetoot dmesg_7.1.0-rc3-00001-g994246ea1eed  
> [    4.296358] Bluetooth: Core ver 2.22
> [    4.296385] Bluetooth: HCI device and connection manager initialized
> [    4.296393] Bluetooth: HCI socket layer initialized
> [    4.296399] Bluetooth: L2CAP socket layer initialized
> [    4.296404] Bluetooth: SCO socket layer initialized
> [    4.391514] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20251223091725
> [    6.087152] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
> [    6.087165] Bluetooth: BNEP filters: protocol multicast
> [    6.087172] Bluetooth: BNEP socket layer initialized
> [    7.591891] Bluetooth: hci0: Device setup in 3127955 usecs
> [    7.591922] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
> [    7.657339] Bluetooth: MGMT ver 1.23
> [   25.883135] Bluetooth: RFCOMM TTY layer initialized
> [   25.883150] Bluetooth: RFCOMM socket layer initialized
> [   25.883154] Bluetooth: RFCOMM ver 1.11

Re: Linux 7.1-rc3 regression (Bluetooth)

[August Wikerfors]

On 2026-05-11 08:30, Thorsten Leemhuis wrote:
> On 5/11/26 07:17, markus.suvanto@gmail.com wrote:
>> Hello
>>
>> I upgrade 7.1-rc2 to 7.1-rc3. After that bluetooth  didn't start
>> hci0: Failed to send wmt func ctrl (-22)
>> My fix was to revert commit 634a4408c0615c523cf7531790f4f14a422b9206
> 
> Thx for your report. FWIW, there are two proposed fixed for this change
> floating around:
> 
> https://lore.kernel.org/all/20260508173121.27526-1-mikhail.v.gavrilov@gmail.com/
> https://lore.kernel.org/all/770d36b07311bf88210c187923f243fb9f126f04.1777058551.git.pav@iki.fi/
> 
> Given that this is the third revert within a short time-frame I wonder
> if we should fast-track a fix (once ready) to spare more users the pain
> of bisecting & reporting.

FYI the commit that caused this regression was backported to the latest
stable releases (6.12.88, 6.18.30 and 7.0.7). I encountered it after
updating to 7.0.7 and can confirm that the patch from the second link
fixes it. That patch is now in the bluetooth tree as e3ac0d9f1a20
("Bluetooth: btmtk: accept too short WMT FUNC_CTRL events") and a pull
request [1] has been made to the net tree. Unfortunately this seems to
have been a few hours too late to make it into the net pull request for
7.1-rc4 [2], so the fix might not get into mainline until next week.

As a side note, it is unfortunate that there does not seem to be a
process to prevent patches that are known to cause regressions from
being backported to stable releases. As far as I can tell, this was
added to regzbot tracking [3] a day before the culprit was queued for
stable [4], so such a process could have prevented this regression in
stable releases.

[1] https://lore.kernel.org/all/20260514172340.1515042-1-luiz.dentz@gmail.com/
[2] https://lore.kernel.org/all/20260514142703.267609-1-pabeni@redhat.com/
[3] https://lore.kernel.org/all/8a17737e-ba9b-4842-a429-c4eab3abcdec@leemhuis.info/
[4] https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/commit/?id=7780f283d14c8c6bf40fe9262219ad821a5dae80

Regards,
August Wikerfors