[PATCH] Bluetooth: btsdio: disable the TX work on removal

[Myeonghun Pak <mhun512@gmail.com>]

btsdio_remove() cancels data->work before hci_unregister_dev() stops
the HCI command and TX workers. They can still call btsdio_send_frame()
and queue it again, allowing it to run after hci_free_dev() or release
of the devm-allocated driver data.

Use disable_work_sync() to drain the work and reject later queueing.
Probe initializes fresh work on rebind.

Found by a static analysis tool under development.

Fixes: 73f7b171b7c0 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition")
Cc: stable@vger.kernel.org # v6.10+
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>

---

 drivers/bluetooth/btsdio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
index a194fc85abfb..680965e74bcc 100644
--- a/drivers/bluetooth/btsdio.c
+++ b/drivers/bluetooth/btsdio.c
@@ -350,7 +350,7 @@ static void btsdio_remove(struct sdio_func *func)
 	if (!data)
 		return;
 
-	cancel_work_sync(&data->work);
+	disable_work_sync(&data->work);
 	hdev = data->hdev;
 
 	sdio_set_drvdata(func, NULL);

base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47
-- 
2.43.0