[PATCH] Bluetooth: hci_qca: Clear memdump state on invalid dump size

[PATCH] Bluetooth: hci_qca: Clear memdump state on invalid dump size

[Ruoyu Wang]

qca_controller_memdump() allocates qca->qca_memdump before processing
the first dump packet. For a sequence-zero packet it then disables IBS,
marks memdump collection active, and reads the advertised dump size.

If the controller reports a zero dump size, the error path frees the
local qca_memdump object and returns without clearing qca->qca_memdump
or undoing the collection state. A later memdump work item initializes
its local pointer from qca->qca_memdump and skips allocation when that
pointer is non-NULL, so it can operate on freed memory. The stale
collection and IBS-disabled flags can also leave waiters or later
transmit handling blocked behind an aborted dump.

Clear the saved pointer and memdump state before returning from the
invalid-size path, matching the cleanup used when hci_devcd_init() fails.

A static analysis checker reported the stale memdump state, and manual
source review confirmed the invalid-size failure path.

Fixes: 06d3fdfcdf5c ("Bluetooth: hci_qca: Add qcom devcoredump support")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/bluetooth/hci_qca.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index b2d1ee3a3d115..1222f97800f4a 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -1087,6 +1087,10 @@ static void qca_controller_memdump(struct work_struct *work)
 			if (!(qca_memdump->ram_dump_size)) {
 				bt_dev_err(hu->hdev, "Rx invalid memdump size");
 				kfree(qca_memdump);
+				qca->qca_memdump = NULL;
+				qca->memdump_state = QCA_MEMDUMP_COLLECTED;
+				clear_and_wake_up_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
+				clear_bit(QCA_IBS_DISABLED, &qca->flags);
 				kfree_skb(skb);
 				mutex_unlock(&qca->hci_memdump_lock);
 				return;
-- 
2.51.0

Re: [PATCH] Bluetooth: hci_qca: Clear memdump state on invalid dump size

[Paul Menzel]

[Cc: +Zijun Hu from Qualcomm]

Dear Ruoyu,


Thank you for your patch.

Am 09.07.26 um 08:22 schrieb Ruoyu Wang:
> qca_controller_memdump() allocates qca->qca_memdump before processing
> the first dump packet. For a sequence-zero packet it then disables IBS,
> marks memdump collection active, and reads the advertised dump size.
> 
> If the controller reports a zero dump size, the error path frees the
> local qca_memdump object and returns without clearing qca->qca_memdump
> or undoing the collection state. A later memdump work item initializes
> its local pointer from qca->qca_memdump and skips allocation when that
> pointer is non-NULL, so it can operate on freed memory. The stale
> collection and IBS-disabled flags can also leave waiters or later
> transmit handling blocked behind an aborted dump.
> 
> Clear the saved pointer and memdump state before returning from the
> invalid-size path, matching the cleanup used when hci_devcd_init() fails.
> 
> A static analysis checker reported the stale memdump state, and manual
> source review confirmed the invalid-size failure path.
> 
> Fixes: 06d3fdfcdf5c ("Bluetooth: hci_qca: Add qcom devcoredump support")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
> ---
>   drivers/bluetooth/hci_qca.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
> index b2d1ee3a3d115..1222f97800f4a 100644
> --- a/drivers/bluetooth/hci_qca.c
> +++ b/drivers/bluetooth/hci_qca.c
> @@ -1087,6 +1087,10 @@ static void qca_controller_memdump(struct work_struct *work)
>   			if (!(qca_memdump->ram_dump_size)) {
>   				bt_dev_err(hu->hdev, "Rx invalid memdump size");
>   				kfree(qca_memdump);
> +				qca->qca_memdump = NULL;
> +				qca->memdump_state = QCA_MEMDUMP_COLLECTED;
> +				clear_and_wake_up_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
> +				clear_bit(QCA_IBS_DISABLED, &qca->flags);
>   				kfree_skb(skb);
>   				mutex_unlock(&qca->hci_memdump_lock);
>   				return;

Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>


Kind regards,

Paul


PS: gemini/gemini-3.1-pro-preview commented on several pre-existing 
issues [1], ideally Qualcomm would look at.

[1]: 
https://sashiko.dev/#/patchset/20260709062250.4166128-1-ruoyuw560%40gmail.com

Re: [PATCH] Bluetooth: hci_qca: Clear memdump state on invalid dump size

[Zijun Hu]

On 7/9/2026 3:26 PM, Paul Menzel wrote:
> 
> diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
> index b2d1ee3a3d115..1222f97800f4a 100644
> --- a/drivers/bluetooth/hci_qca.c
> +++ b/drivers/bluetooth/hci_qca.c
> @@ -1087,6 +1087,10 @@ static void qca_controller_memdump(struct work_struct *work)
>               if (!(qca_memdump->ram_dump_size)) {
>                   bt_dev_err(hu->hdev, "Rx invalid memdump size");
>                   kfree(qca_memdump);
> +                qca->qca_memdump = NULL;
> +                qca->memdump_state = QCA_MEMDUMP_COLLECTED;
> +                clear_and_wake_up_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
> +                clear_bit(QCA_IBS_DISABLED, &qca->flags);
>                   kfree_skb(skb);
>                   mutex_unlock(&qca->hci_memdump_lock);
>                   return;

Reviewed-by: Zijun Hu <zijun.hu@oss.qualcomm.com>

RE: Bluetooth: hci_qca: Clear memdump state on invalid dump size

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1124325

---Test result---

Test Summary:
CheckPatch                    PASS      0.82 seconds
VerifyFixes                   PASS      0.13 seconds
VerifySignedoff               PASS      0.13 seconds
GitLint                       PASS      0.35 seconds
SubjectPrefix                 PASS      5.21 seconds
BuildKernel                   PASS      27.74 seconds
CheckAllWarning               PASS      30.80 seconds
CheckSparse                   PASS      34.04 seconds
BuildKernel32                 PASS      27.48 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      513.18 seconds
IncrementalBuild              PASS      27.01 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/415

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: hci_qca: Clear memdump state on invalid dump size

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu,  9 Jul 2026 14:22:50 +0800 you wrote:
> qca_controller_memdump() allocates qca->qca_memdump before processing
> the first dump packet. For a sequence-zero packet it then disables IBS,
> marks memdump collection active, and reads the advertised dump size.
> 
> If the controller reports a zero dump size, the error path frees the
> local qca_memdump object and returns without clearing qca->qca_memdump
> or undoing the collection state. A later memdump work item initializes
> its local pointer from qca->qca_memdump and skips allocation when that
> pointer is non-NULL, so it can operate on freed memory. The stale
> collection and IBS-disabled flags can also leave waiters or later
> transmit handling blocked behind an aborted dump.
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_qca: Clear memdump state on invalid dump size
    https://git.kernel.org/bluetooth/bluetooth-next/c/fd694aebe414

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html