[PATCH] Bluetooth: hci_qca: clear qca_memdump when discarding dump packets

[Joas Antonio dos Santos via B4 Relay <devnull+joasantonio108.gmail.com@kernel.org>]

From: Joas Antonio dos Santos <joasantonio108@gmail.com>

qca_controller_memdump() frees qca_memdump when a memdump packet with a
non-zero sequence number arrives while QCA_MEMDUMP_COLLECTION is not
set, but leaves qca->qca_memdump pointing at the freed object.

The next run of the work reads the stale pointer into its local
variable, skips the allocation and uses the freed memory.  Another
packet with a non-zero sequence number frees it a second time, and a
packet with sequence number 0 writes ram_dump_size, current_seq_no and
received_dump into it.

The original code cleared the pointer here; the assignment was dropped
when the condition was changed to test QCA_MEMDUMP_COLLECTION.  All
other places that free the structure clear the pointer.

A controller that sends two memdump events without a leading sequence
number 0 can trigger a use-after-free or double free of a kmalloc
object.

Found by LLM-assisted source review.

Fixes: 06d3fdfcdf5c ("Bluetooth: hci_qca: Add qcom devcoredump support")
Cc: stable@vger.kernel.org
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
---
This issue was found with the help of an LLM-based code review tool
(Claude).  I checked the code paths by hand against v7.4-rc3 and
reviewed the fix myself.  It is build-tested only (W=1, arm64); I do
not have the hardware to test it at runtime.
---
 drivers/bluetooth/hci_qca.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index e480d38109cf..9dd8aa0ca8b1 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -1127,6 +1127,7 @@ static void qca_controller_memdump(struct work_struct *work)
 		if (!test_bit(QCA_MEMDUMP_COLLECTION, &qca->flags)) {
 			bt_dev_err(hu->hdev, "QCA: Discarding other packets");
 			kfree(qca_memdump);
+			qca->qca_memdump = NULL;
 			kfree_skb(skb);
 			mutex_unlock(&qca->hci_memdump_lock);
 			return;

---
base-commit: b3dfbde62cf1981c4638939c159dfd087b7a72e9
change-id: 20261110-hci-qca-memdump-21c6294ef93d

Best regards,
-- 
Joas Antonio dos Santos <joasantonio108@gmail.com>