[PATCH v2] Bluetooth: btintel_pcie: guard debug dump before hdev setup

[PATCH v2] Bluetooth: btintel_pcie: guard debug dump before hdev setup

[ChunAn Wu]

An MSI-X interrupt can reach the debug-dump helper before
btintel_pcie_setup_hdev() initializes data->hdev. The helper then
passes NULL to hci_get_drvdata() and crashes the interrupt thread.

Return early when hdev is not available. This covers the GP1 and GP0
error paths while leaving interrupt handling unchanged.

Fixes: 190377500fde ("Bluetooth: btintel_pcie: Dump debug registers on error")
Cc: stable@vger.kernel.org
Signed-off-by: ChunAn Wu <an.wu@canonical.com>
---
Changes in v2:
- Add the missing Fixes: tag required for the stable CC.

---
 drivers/bluetooth/btintel_pcie.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index ac7193400769..8d7927bd75b6 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -297,12 +297,17 @@ static void btintel_pcie_prepare_tx(struct txq *txq, u16 tfd_index,
 
 static inline void btintel_pcie_dump_debug_registers(struct hci_dev *hdev)
 {
-	struct btintel_pcie_data *data = hci_get_drvdata(hdev);
+	struct btintel_pcie_data *data;
 	u16 cr_hia, cr_tia;
 	u32 reg, mbox_reg;
 	struct sk_buff *skb;
 	u8 buf[80];
 
+	if (!hdev)
+		return;
+
+	data = hci_get_drvdata(hdev);
+
 	skb = alloc_skb(1024, GFP_ATOMIC);
 	if (!skb)
 		return;

base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
-- 
2.34.1

Re: [PATCH v2] Bluetooth: btintel_pcie: guard debug dump before hdev setup

[ChunAn Wu]

On Tue, Oct 13, 2026 at 08:52:41PM +0800, ChunAn Wu wrote:
> An MSI-X interrupt can reach the debug-dump helper before
> btintel_pcie_setup_hdev() initializes data->hdev. The helper then
> passes NULL to hci_get_drvdata() and crashes the interrupt thread.
> 
> Return early when hdev is not available. This covers the GP1 and GP0
> error paths while leaving interrupt handling unchanged.
> 
> Fixes: 190377500fde ("Bluetooth: btintel_pcie: Dump debug registers on error")
> Cc: stable@vger.kernel.org
> Signed-off-by: ChunAn Wu <an.wu@canonical.com>
> ---
> Changes in v2:
> - Add the missing Fixes: tag required for the stable CC.
> 
> ---
>  drivers/bluetooth/btintel_pcie.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
> index ac7193400769..8d7927bd75b6 100644
> --- a/drivers/bluetooth/btintel_pcie.c
> +++ b/drivers/bluetooth/btintel_pcie.c
> @@ -297,12 +297,17 @@ static void btintel_pcie_prepare_tx(struct txq *txq, u16 tfd_index,
>  
>  static inline void btintel_pcie_dump_debug_registers(struct hci_dev *hdev)
>  {
> -	struct btintel_pcie_data *data = hci_get_drvdata(hdev);
> +	struct btintel_pcie_data *data;
>  	u16 cr_hia, cr_tia;
>  	u32 reg, mbox_reg;
>  	struct sk_buff *skb;
>  	u8 buf[80];
>  
> +	if (!hdev)
> +		return;
> +
> +	data = hci_get_drvdata(hdev);
> +
>  	skb = alloc_skb(1024, GFP_ATOMIC);
>  	if (!skb)
>  		return;
> 
> base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
> -- 
> 2.34.1
Hi Maintainers,
Could you kindly help me to review the patch
Many thanks

BR
    An