Re: [PATCH] Bluetooth: hci_qca: Clear memdump state on invalid dump size

[Paul Menzel <pmenzel@molgen.mpg.de>]

[Cc: +Zijun Hu from Qualcomm]

Dear Ruoyu,


Thank you for your patch.

Am 09.07.26 um 08:22 schrieb Ruoyu Wang:
> qca_controller_memdump() allocates qca->qca_memdump before processing
> the first dump packet. For a sequence-zero packet it then disables IBS,
> marks memdump collection active, and reads the advertised dump size.
> 
> If the controller reports a zero dump size, the error path frees the
> local qca_memdump object and returns without clearing qca->qca_memdump
> or undoing the collection state. A later memdump work item initializes
> its local pointer from qca->qca_memdump and skips allocation when that
> pointer is non-NULL, so it can operate on freed memory. The stale
> collection and IBS-disabled flags can also leave waiters or later
> transmit handling blocked behind an aborted dump.
> 
> Clear the saved pointer and memdump state before returning from the
> invalid-size path, matching the cleanup used when hci_devcd_init() fails.
> 
> A static analysis checker reported the stale memdump state, and manual
> source review confirmed the invalid-size failure path.
> 
> Fixes: 06d3fdfcdf5c ("Bluetooth: hci_qca: Add qcom devcoredump support")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
> ---
>   drivers/bluetooth/hci_qca.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
> index b2d1ee3a3d115..1222f97800f4a 100644
> --- a/drivers/bluetooth/hci_qca.c
> +++ b/drivers/bluetooth/hci_qca.c
> @@ -1087,6 +1087,10 @@ static void qca_controller_memdump(struct work_struct *work)
>   			if (!(qca_memdump->ram_dump_size)) {
>   				bt_dev_err(hu->hdev, "Rx invalid memdump size");
>   				kfree(qca_memdump);
> +				qca->qca_memdump = NULL;
> +				qca->memdump_state = QCA_MEMDUMP_COLLECTED;
> +				clear_and_wake_up_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
> +				clear_bit(QCA_IBS_DISABLED, &qca->flags);
>   				kfree_skb(skb);
>   				mutex_unlock(&qca->hci_memdump_lock);
>   				return;

Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>


Kind regards,

Paul


PS: gemini/gemini-3.1-pro-preview commented on several pre-existing 
issues [1], ideally Qualcomm would look at.

[1]: 
https://sashiko.dev/#/patchset/20260709062250.4166128-1-ruoyuw560%40gmail.com