Re: [PATCH] Bluetooth: hci_qca: clear qca_memdump when discarding dump packets

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Tue, 10 Nov 2026 03:55:41 +0000 you wrote:
> From: Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>
> 
> qca_controller_memdump() frees qca_memdump when a memdump packet with a
> non-zero sequence number arrives while QCA_MEMDUMP_COLLECTION is not
> set, but leaves qca->qca_memdump pointing at the freed object.
> 
> The next run of the work reads the stale pointer into its local
> variable, skips the allocation and uses the freed memory.  Another
> packet with a non-zero sequence number frees it a second time, and a
> packet with sequence number 0 writes ram_dump_size, current_seq_no and
> received_dump into it.
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_qca: clear qca_memdump when discarding dump packets
    https://git.kernel.org/bluetooth/bluetooth-next/c/45a25a1bfd26

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html