[PATCH 0/2] Bluetooth: btmtk: fix ISO data reception

[Chris Lu]

Two problems in btmtk_recv_isopkt(), both found while debugging LE Audio
on MT7925. The function is shared by every MediaTek USB controller that
supports ISO data, so neither is specific to that part.

Patch 1 stops the zero padding emitted by the ISO interrupt IN endpoint
from being parsed as ISO packets. The endpoint delivers one packet per
264-byte transfer and zero-fills the rest; the driver turns every four
zero bytes into a handle 0 packet with Data_Total_Length 0 and reports it
to the stack. A single transfer can inject up to 64 of them, which is
what fills the HCI log with malformed ISO frames, and a valid SDU is lost
whenever handle 0 belongs to a live CIS/BIS.

Patch 2 corrects the receive skb being allocated 4 bytes too small, so
that a 248..251 byte payload would be rejected with -EILSEQ.
HCI_MAX_ISO_SIZE is a payload limit rather than a frame limit, and the
allocation should reflect that.

The two hunks are independent, so patch 1 applies on its own if you would
rather not take patch 2.

Based on bluetooth-next.

Chris Lu (2):
  Bluetooth: btmtk: drop zero-length ISO packets from endpoint padding
  Bluetooth: btmtk: size the ISO receive skb to hold header plus payload

 drivers/bluetooth/btmtk.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

-- 
2.45.2