[REGRESSION] MT7925 Bluetooth fails to initialize after btmtk fix 634a4408c061 ("Bluetooth: btmtk: validate WMT event SKB length")

I bisected a regression on MediaTek MT7925 (Framework Desktop) in linux-7.0.y which appears responsible for this issue. It initializes and works correctly in 7.0.6 but not in 7.0.7.

The bisect landed on commit 70d37a8b9229e394cc17ddad47e90b81d80fcd09 which is a backport of 634a4408c0615c523cf7531790f4f14a422b9206:

commit 634a4408c0615c523cf7531790f4f14a422b9206
Author: Tristan Madani <[email protected]>
Date:   Tue Apr 21 11:14:54 2026 +0000

    Bluetooth: btmtk: validate WMT event SKB length before struct access

    btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to
    struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc
    (9 bytes) without first checking that the SKB contains enough data.
    A short firmware response causes out-of-bounds reads from SKB tailroom.

    Use skb_pull_data() to validate and advance past the base WMT event
    header. For the FUNC_CTRL case, pull the additional status field bytes
    before accessing them.

    Fixes: d019930b0049 ("Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c")
    Cc: [email protected]
    Signed-off-by: Tristan Madani <[email protected]>
    Signed-off-by: Luiz Augusto von Dentz <[email protected]>

In dmesg, the failure shows up as:

    Bluetooth: hci0: Failed to send wmt func ctrl (-22)

Cheers!

#regzbot introduced: 634a4408c0615c523cf7531790f4f14a422b9206

-- 

  Aaron Muir Hamilton
  +1 313 240 2152  +1 307 365 7527