After the hci_sync rework, cmd_sync_work was cleared when calling hci_unregister_dev, but not when powering off the adapter. Use-after-free errors happened because a work is still scheduled when cmd is freed by __mgmt_power_off. Changes in v1: - Clear cmd_sync_work queue before clearing the mgmt cmd list Zhengping Jiang (1): Bluetooth: hci_sync: clear workqueue before clear mgmt cmd net/bluetooth/hci_sync.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.39.2.637.g21b0678d19-goog
