[PATCH v2 0/3] Bluetooth: btmtk: firmware debug event routing and WMT FUNC_CTRL status fixes

[Chris Lu]

This series bundles three independent MediaTek Bluetooth driver fixes:

Patch 1 is a resend of a fix submitted on 25 Aug 2026
("Bluetooth: btmtk: Route firmware debug event to the diag channel")
that received no review feedback at the time.

Patches 2-3 fix how btmtk_usb_hci_wmt_sync() (and its btmtksdio.c /
btmtkuart.c counterparts) interpret a WMT FUNC_CTRL event that carries
only the WMT header and no trailing 2-byte status word. Such an event
is a normal firmware ack for a plain enable/disable request, with the
result carried in the header's own flag byte, not a failure as the
current code assumes:

  - Patch 2 fixes this for btmtk.c, where a bounds check already
    existed (added by e3ac0d9f1a20) but defaulted to the wrong
    result.
  - Patch 3 applies the same fix to btmtksdio.c and btmtkuart.c, which
    never had a bounds check for this event at all and read 2 bytes
    past the end of the received SKB whenever firmware sent the short
    form. While there, it also adds the missing base WMT header length
    check that btmtk.c already has (skb_pull_data() before touching
    wmt_evt->whdr.op), since these two files were unconditionally
    dereferencing that field with no length validation at all.

Changes since v1:
 - Patch 1: review asked whether the exact match on the ACL handle
   (0x2efd) could miss a continuation fragment (0x1efd) if the
   firmware debug event ever spans multiple ACL packets. Confirmed
   with MTK internally that this event's wire format is fixed at a
   single ACL_START packet, so a comment was added above the switch
   in both btmtk.c and btmtksdio.c explaining that HCI fragmentation
   does not apply to this handle (and the other vendor-reserved ones
   already handled there).
 - Patches 2, 3: no changes.

Chris Lu (3):
  Bluetooth: btmtk: Route firmware debug event to the diag channel
  Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events
  Bluetooth: btmtksdio, btmtkuart: validate WMT event length before
    struct access

 drivers/bluetooth/btmtk.c     | 15 ++++++++++++++-
 drivers/bluetooth/btmtksdio.c | 28 +++++++++++++++++++++++++++-
 drivers/bluetooth/btmtkuart.c | 20 +++++++++++++++++++-
 3 files changed, 60 insertions(+), 3 deletions(-)

--
2.45.2