imrcpan/erofs-linux
1
0 Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git synced 2026-10-28 21:02:43 +01:00
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: btmtk: accept too short WMT FUNC_CTRL events

Browse Source 
MT7925 (USB ID 0e8d:e025) on fw version 20260106153314 sends WMT
FUNC_CTRL events that are missing the status field.

Prior to commit 006b9943b982 ("Bluetooth: btmtk: validate WMT event SKB
length before struct access") the status was read from out-of-bounds of
SKB data, which usually would result to success with
BTMTK_WMT_ON_UNDONE, although I don't know the intent here.  The bounds
check added in that commit returns with error instead, producing
"Bluetooth: hci0: Failed to send wmt func ctrl (-22)" and makes the
device unusable.

Fix the regression by interpreting too short packet as status
BTMTK_WMT_ON_UNDONE, which makes the device work normally again.

Fixes: 634a4408c0 ("Bluetooth: btmtk: validate WMT event SKB length before struct access")
Signed-off-by: Pauli Virtanen <[email protected]>
Tested-by: Mikhail Gavrilov <[email protected]> # MT7922 (0489:e0e2)
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
This commit is contained in:
Pauli Virtanen authored and Luiz Augusto von Dentz committed 2026-05-14 09:54:06 -04:00
1 parent e83f5e24da
commit e3ac0d9f1a
1 file changed
+2 -2
Download Patch File Download Diff File Expand all files Collapse all files
drivers/bluetooth/btmtk.c
+2 -2
View File
@@ -719,8 +719,8 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
case BTMTK_WMT_FUNC_CTRL:
if (!skb_pull_data(data->evt_skb,
sizeof(wmt_evt_funcc->status))) {
err = -EINVAL;
goto err_free_skb;
status = BTMTK_WMT_ON_UNDONE;
break;
}
wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;