Re: [PATCH] Bluetooth: hci_qca: Clear memdump state on invalid dump size

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Thu,  9 Jul 2026 14:22:50 +0800 you wrote:
> qca_controller_memdump() allocates qca->qca_memdump before processing
> the first dump packet. For a sequence-zero packet it then disables IBS,
> marks memdump collection active, and reads the advertised dump size.
> 
> If the controller reports a zero dump size, the error path frees the
> local qca_memdump object and returns without clearing qca->qca_memdump
> or undoing the collection state. A later memdump work item initializes
> its local pointer from qca->qca_memdump and skips allocation when that
> pointer is non-NULL, so it can operate on freed memory. The stale
> collection and IBS-disabled flags can also leave waiters or later
> transmit handling blocked behind an aborted dump.
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_qca: Clear memdump state on invalid dump size
    https://git.kernel.org/bluetooth/bluetooth-next/c/fd694aebe414

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html