Re: [PATCH] Bluetooth: hci_qca: fix use-after-free in ibs debugfs files

[Bartosz Golaszewski]

On Thu, Nov 05, 2026 at 01:56:45PM +0800, YuanZhe Liu wrote:
> qca_debugfs_init() creates an "ibs" directory under hdev->debugfs and
> stores pointers to fields of struct qca_data in the debugfs files.
> qca_close() frees qca_data without removing that directory, while
> hdev->debugfs is only removed when the HCI device is released. The HCI
> device can outlive the driver data, for example when an HCI socket still
> references it, so reading or writing one of the ibs files then
> dereferences freed memory.
> 
> Store the directory dentry in struct qca_data and remove the directory
> with debugfs_remove_recursive() before qca_data is freed.
> debugfs_remove() waits for callers that are already inside the file
> operations, and any later access fails with -EIO instead of reaching the
> debugfs helpers. This covers the two writable files as well.
> 
> Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261102113654.8724-1-25031212351%40stu.xidian.edu.cn
> Fixes: 0ff252c1976d ("Bluetooth: hciuart: Add support QCA chipset for UART")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: YuanZhe Liu <25031212351@xxxxxxxxxxxxxxxxx>
> ---

Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@xxxxxxxxxxxxxxxx>