[PATCH v2 1/2] Bluetooth: btusb: Return when coredump trigger cmd fails

[PATCH v2 1/2] Bluetooth: btusb: Return when coredump trigger cmd fails

[Manish Mandlik]

Avoid freeing NULL skb when hci command fails.

Fixes: 20981ce2d5a5 ("Bluetooth: btusb: Add WCN6855 devcoredump support")

Signed-off-by: Manish Mandlik <mmandlik@google.com>
---

Changes in v2:
- Fixed a typo in error log in btusb_coredump_qca()

 drivers/bluetooth/btusb.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index b8e9de887b5d..35a26440cabd 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3463,8 +3463,11 @@ static void btusb_coredump_qca(struct hci_dev *hdev)
 	struct sk_buff *skb;
 
 	skb = __hci_cmd_sync(hdev, 0xfc0c, 1, param, HCI_CMD_TIMEOUT);
-	if (IS_ERR(skb))
-		bt_dev_err(hdev, "%s: triggle crash failed (%ld)", __func__, PTR_ERR(skb));
+	if (IS_ERR(skb)) {
+		bt_dev_err(hdev, "%s: trigger crash failed (%ld)", __func__, PTR_ERR(skb));
+		return;
+	}
+
 	kfree_skb(skb);
 }
 
-- 
2.43.0.rc0.421.g78406f8d94-goog

[PATCH v2 2/2] Bluetooth: btusb: Fix double free in handle_dump_pkt_qca()

[Manish Mandlik]

The hci_devcd_init() returns 0 on success. Do not use this return value
when eturning from handle_dump_pkt_qca() as it incorrectly indicates
that it's not a dump packet.

This causes the first dump skb to be processed by both hci_devcd_rx()
and hci_recv_frame() leading to double free.

Fixes: 20981ce2d5a5 ("Bluetooth: btusb: Add WCN6855 devcoredump support")

Signed-off-by: Manish Mandlik <mmandlik@google.com>
---

(no changes since v1)

 drivers/bluetooth/btusb.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 35a26440cabd..d23c992502c5 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3531,10 +3531,11 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb)
 			goto out;
 		}
 
-		ret = hci_devcd_init(hdev, dump_size);
-		if (ret < 0) {
-			bt_dev_err(hdev, "memdump init error(%d)", ret);
-			goto out;
+		if (hci_devcd_init(hdev, dump_size) < 0) {
+			bt_dev_err(hdev, "memdump init error");
+			clear_bit(BTUSB_HW_SSR_ACTIVE, &btdata->flags);
+			kfree_skb(skb);
+			return ret;
 		}
 
 		btdata->qca_dump.ram_dump_size = dump_size;
-- 
2.43.0.rc0.421.g78406f8d94-goog

RE: [v2,1/2] Bluetooth: btusb: Return when coredump trigger cmd fails

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1422 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=802039

---Test result---

Test Summary:
CheckPatch                    PASS      1.25 seconds
GitLint                       PASS      0.63 seconds
SubjectPrefix                 PASS      0.27 seconds
BuildKernel                   PASS      27.85 seconds
CheckAllWarning               PASS      30.67 seconds
CheckSparse                   PASS      36.17 seconds
CheckSmatch                   PASS      99.43 seconds
BuildKernel32                 PASS      27.06 seconds
TestRunnerSetup               PASS      418.24 seconds
TestRunner_l2cap-tester       PASS      22.99 seconds
TestRunner_iso-tester         PASS      40.48 seconds
TestRunner_bnep-tester        PASS      7.39 seconds
TestRunner_mgmt-tester        PASS      166.09 seconds
TestRunner_rfcomm-tester      PASS      11.09 seconds
TestRunner_sco-tester         PASS      14.54 seconds
TestRunner_ioctl-tester       PASS      12.09 seconds
TestRunner_mesh-tester        PASS      8.94 seconds
TestRunner_smp-tester         PASS      9.73 seconds
TestRunner_userchan-tester    PASS      7.33 seconds
IncrementalBuild              PASS      31.82 seconds



---
Regards,
Linux Bluetooth