[PATCH] Bluetooth: hci_sync: Cancel cmd_timer before draining workqueue

[rabindra789 <rabindrameher116@gmail.com>]

cmd_timer can expire while hdev->workqueue is being drained,
causing hci_cmd_timeout to be queued on a draining workqueue.

Cancel cmd_timer before draining the workqueue.

Reported-by: syzbot+48fc5b35b350240fd465@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=48fc5b35b350240fd465
Fixes: 40b87657200c ("Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions")

Signed-off-by: rabindra789 <rabindrameher116@gmail.com>
---
 net/bluetooth/hci_sync.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index c01c8b58d9e8..e1c28bffdc15 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -5545,6 +5545,8 @@ int hci_dev_close_sync(struct hci_dev *hdev)
 	 */
 	hci_dev_set_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
 	synchronize_rcu();
+	/* Explicitly cancel works in case scheduled after setting the flag. */
+	cancel_delayed_work_sync(&hdev->cmd_timer);
 
 	if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
 		disable_delayed_work(&hdev->power_off);
-- 
2.43.0