[PATCH] Bluetooth: hci_qca: Clear memdump state on invalid dump size

[PATCH] Bluetooth: hci_qca: Clear memdump state on invalid dump size

[Ruoyu Wang]

qca_controller_memdump() allocates qca->qca_memdump before processing
the first dump packet. For a sequence-zero packet it then disables IBS,
marks memdump collection active, and reads the advertised dump size.

If the controller reports a zero dump size, the error path frees the
local qca_memdump object and returns without clearing qca->qca_memdump
or undoing the collection state. A later memdump work item initializes
its local pointer from qca->qca_memdump and skips allocation when that
pointer is non-NULL, so it can operate on freed memory. The stale
collection and IBS-disabled flags can also leave waiters or later
transmit handling blocked behind an aborted dump.

Clear the saved pointer and memdump state before returning from the
invalid-size path, matching the cleanup used when hci_devcd_init() fails.

A static analysis checker reported the stale memdump state, and manual
source review confirmed the invalid-size failure path.

Fixes: 06d3fdfcdf5c ("Bluetooth: hci_qca: Add qcom devcoredump support")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/bluetooth/hci_qca.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index b2d1ee3a3d115..1222f97800f4a 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -1087,6 +1087,10 @@ static void qca_controller_memdump(struct work_struct *work)
 			if (!(qca_memdump->ram_dump_size)) {
 				bt_dev_err(hu->hdev, "Rx invalid memdump size");
 				kfree(qca_memdump);
+				qca->qca_memdump = NULL;
+				qca->memdump_state = QCA_MEMDUMP_COLLECTED;
+				clear_and_wake_up_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
+				clear_bit(QCA_IBS_DISABLED, &qca->flags);
 				kfree_skb(skb);
 				mutex_unlock(&qca->hci_memdump_lock);
 				return;
-- 
2.51.0

Re: [PATCH] Bluetooth: hci_qca: Clear memdump state on invalid dump size

[Paul Menzel]

[Cc: +Zijun Hu from Qualcomm]

Dear Ruoyu,


Thank you for your patch.

Am 09.07.26 um 08:22 schrieb Ruoyu Wang:
> qca_controller_memdump() allocates qca->qca_memdump before processing
> the first dump packet. For a sequence-zero packet it then disables IBS,
> marks memdump collection active, and reads the advertised dump size.
> 
> If the controller reports a zero dump size, the error path frees the
> local qca_memdump object and returns without clearing qca->qca_memdump
> or undoing the collection state. A later memdump work item initializes
> its local pointer from qca->qca_memdump and skips allocation when that
> pointer is non-NULL, so it can operate on freed memory. The stale
> collection and IBS-disabled flags can also leave waiters or later
> transmit handling blocked behind an aborted dump.
> 
> Clear the saved pointer and memdump state before returning from the
> invalid-size path, matching the cleanup used when hci_devcd_init() fails.
> 
> A static analysis checker reported the stale memdump state, and manual
> source review confirmed the invalid-size failure path.
> 
> Fixes: 06d3fdfcdf5c ("Bluetooth: hci_qca: Add qcom devcoredump support")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
> ---
>   drivers/bluetooth/hci_qca.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
> index b2d1ee3a3d115..1222f97800f4a 100644
> --- a/drivers/bluetooth/hci_qca.c
> +++ b/drivers/bluetooth/hci_qca.c
> @@ -1087,6 +1087,10 @@ static void qca_controller_memdump(struct work_struct *work)
>   			if (!(qca_memdump->ram_dump_size)) {
>   				bt_dev_err(hu->hdev, "Rx invalid memdump size");
>   				kfree(qca_memdump);
> +				qca->qca_memdump = NULL;
> +				qca->memdump_state = QCA_MEMDUMP_COLLECTED;
> +				clear_and_wake_up_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
> +				clear_bit(QCA_IBS_DISABLED, &qca->flags);
>   				kfree_skb(skb);
>   				mutex_unlock(&qca->hci_memdump_lock);
>   				return;

Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>


Kind regards,

Paul


PS: gemini/gemini-3.1-pro-preview commented on several pre-existing 
issues [1], ideally Qualcomm would look at.

[1]: 
https://sashiko.dev/#/patchset/20260709062250.4166128-1-ruoyuw560%40gmail.com

Re: [PATCH] Bluetooth: hci_qca: Clear memdump state on invalid dump size

[Zijun Hu]

On 7/9/2026 3:26 PM, Paul Menzel wrote:
> 
> diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
> index b2d1ee3a3d115..1222f97800f4a 100644
> --- a/drivers/bluetooth/hci_qca.c
> +++ b/drivers/bluetooth/hci_qca.c
> @@ -1087,6 +1087,10 @@ static void qca_controller_memdump(struct work_struct *work)
>               if (!(qca_memdump->ram_dump_size)) {
>                   bt_dev_err(hu->hdev, "Rx invalid memdump size");
>                   kfree(qca_memdump);
> +                qca->qca_memdump = NULL;
> +                qca->memdump_state = QCA_MEMDUMP_COLLECTED;
> +                clear_and_wake_up_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
> +                clear_bit(QCA_IBS_DISABLED, &qca->flags);
>                   kfree_skb(skb);
>                   mutex_unlock(&qca->hci_memdump_lock);
>                   return;

Reviewed-by: Zijun Hu <zijun.hu@oss.qualcomm.com>

Re: [PATCH] Bluetooth: hci_qca: Clear memdump state on invalid dump size

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu,  9 Jul 2026 14:22:50 +0800 you wrote:
> qca_controller_memdump() allocates qca->qca_memdump before processing
> the first dump packet. For a sequence-zero packet it then disables IBS,
> marks memdump collection active, and reads the advertised dump size.
> 
> If the controller reports a zero dump size, the error path frees the
> local qca_memdump object and returns without clearing qca->qca_memdump
> or undoing the collection state. A later memdump work item initializes
> its local pointer from qca->qca_memdump and skips allocation when that
> pointer is non-NULL, so it can operate on freed memory. The stale
> collection and IBS-disabled flags can also leave waiters or later
> transmit handling blocked behind an aborted dump.
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_qca: Clear memdump state on invalid dump size
    https://git.kernel.org/bluetooth/bluetooth-next/c/fd694aebe414

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html