diff options
| author |   Pauli Virtanen <pav@iki.fi> | 2026-04-24 22:24:29 +0300 |
|---|---|---|
| committer |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-05-14 09:54:06 -0400 |
| commit | e3ac0d9f1a205f33a43fba3b79ef74d2f604c78b (patch) | |
| tree | 356a7672970234454489045449fa22c28cab114a /include/linux/bcma/ssh:/git@git.zx2c4.com | |
| parent | Bluetooth: serialize accept_q access (diff) | |
Bluetooth: btmtk: accept too short WMT FUNC_CTRL events
MT7925 (USB ID 0e8d:e025) on fw version 20260106153314 sends WMT
FUNC_CTRL events that are missing the status field.
Prior to commit 006b9943b982 ("Bluetooth: btmtk: validate WMT event SKB
length before struct access") the status was read from out-of-bounds of
SKB data, which usually would result to success with
BTMTK_WMT_ON_UNDONE, although I don't know the intent here. The bounds
check added in that commit returns with error instead, producing
"Bluetooth: hci0: Failed to send wmt func ctrl (-22)" and makes the
device unusable.
Fix the regression by interpreting too short packet as status
BTMTK_WMT_ON_UNDONE, which makes the device work normally again.
Fixes: 634a4408c061 ("Bluetooth: btmtk: validate WMT event SKB length before struct access")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> # MT7922 (0489:e0e2)
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include/linux/bcma/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions