Re: [PATCH] Bluetooth: MGMT: Reject quality report requests during unregister

[patchwork-bot+bluetooth@kernel.org]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue,  6 Oct 2026 15:24:31 +0800 you wrote:
> A quality report request must not call a driver callback after its
> module text has been released. hci_mgmt_cmd() holds an hci_dev reference
> through set_exp_feature(), but that reference only preserves the device
> allocation. set_quality_report_func() takes req_lock and invokes
> hdev->set_quality_report without checking HCI_UNREGISTER.
> 
> This is unsafe when a SET_EXP_FEATURE request for an Intel controller
> would change HCI_QUALITY_REPORT and is delayed before taking req_lock
> while the controller is removed. With btintel_pcie and btintel built as
> modules and no other btintel dependents, the following order is
> possible:
> 
> [...]

Here is the summary with links:
  - Bluetooth: MGMT: Reject quality report requests during unregister
    https://git.kernel.org/bluetooth/bluetooth-next/c/ba9fb67965c9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html