[PATCH] Bluetooth: hci_qca: clear qca_memdump when discarding dump packets

[PATCH] Bluetooth: hci_qca: clear qca_memdump when discarding dump packets

[Joas Antonio dos Santos via B4 Relay]

From: Joas Antonio dos Santos <joasantonio108@gmail.com>

qca_controller_memdump() frees qca_memdump when a memdump packet with a
non-zero sequence number arrives while QCA_MEMDUMP_COLLECTION is not
set, but leaves qca->qca_memdump pointing at the freed object.

The next run of the work reads the stale pointer into its local
variable, skips the allocation and uses the freed memory.  Another
packet with a non-zero sequence number frees it a second time, and a
packet with sequence number 0 writes ram_dump_size, current_seq_no and
received_dump into it.

The original code cleared the pointer here; the assignment was dropped
when the condition was changed to test QCA_MEMDUMP_COLLECTION.  All
other places that free the structure clear the pointer.

A controller that sends two memdump events without a leading sequence
number 0 can trigger a use-after-free or double free of a kmalloc
object.

Found by LLM-assisted source review.

Fixes: 06d3fdfcdf5c ("Bluetooth: hci_qca: Add qcom devcoredump support")
Cc: stable@vger.kernel.org
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
---
This issue was found with the help of an LLM-based code review tool
(Claude).  I checked the code paths by hand against v7.4-rc3 and
reviewed the fix myself.  It is build-tested only (W=1, arm64); I do
not have the hardware to test it at runtime.
---
 drivers/bluetooth/hci_qca.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index e480d38109cf..9dd8aa0ca8b1 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -1127,6 +1127,7 @@ static void qca_controller_memdump(struct work_struct *work)
 		if (!test_bit(QCA_MEMDUMP_COLLECTION, &qca->flags)) {
 			bt_dev_err(hu->hdev, "QCA: Discarding other packets");
 			kfree(qca_memdump);
+			qca->qca_memdump = NULL;
 			kfree_skb(skb);
 			mutex_unlock(&qca->hci_memdump_lock);
 			return;

---
base-commit: b3dfbde62cf1981c4638939c159dfd087b7a72e9
change-id: 20261110-hci-qca-memdump-21c6294ef93d

Best regards,
-- 
Joas Antonio dos Santos <joasantonio108@gmail.com>

Re: [PATCH] Bluetooth: hci_qca: clear qca_memdump when discarding dump packets

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 10 Nov 2026 03:55:41 +0000 you wrote:
> From: Joas Antonio dos Santos <joasantonio108@gmail.com>
> 
> qca_controller_memdump() frees qca_memdump when a memdump packet with a
> non-zero sequence number arrives while QCA_MEMDUMP_COLLECTION is not
> set, but leaves qca->qca_memdump pointing at the freed object.
> 
> The next run of the work reads the stale pointer into its local
> variable, skips the allocation and uses the freed memory.  Another
> packet with a non-zero sequence number frees it a second time, and a
> packet with sequence number 0 writes ram_dump_size, current_seq_no and
> received_dump into it.
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_qca: clear qca_memdump when discarding dump packets
    https://git.kernel.org/bluetooth/bluetooth-next/c/45a25a1bfd26

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html