After the hci_sync rework, cmd_sync_work was cleared when calling hci_unregister_dev, but not when powering off the adapter. Use-after-free errors happen when a work is still scheduled when cmd is freed by __mgmt_power_off. Changes in v2: - Add function to clear the queue without stop the timer Changes in v1: - Clear cmd_sync_work queue before clearing the mgmt cmd list Zhengping Jiang (1): Bluetooth: hci_sync: clear workqueue before clear mgmt cmd net/bluetooth/hci_sync.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) -- 2.39.2.722.g9855ee24e9-goog
