[PATCH] Bluetooth: hci_conn: Use disable_delayed_work_sync for le_conn_timeout

[Dudu Lu <phx0fer@gmail.com>]

In hci_conn_del(), the LE_LINK case cancels le_conn_timeout using
cancel_delayed_work(), which is non-synchronous. This means the timeout
handler could still be running after the connection is freed, leading to
a use-after-free.

The other three delayed works in the same function (disc_work,
auto_accept_work, idle_work) already use disable_delayed_work_sync().
Change le_conn_timeout to use disable_delayed_work_sync() as well for
consistency and correctness.

Signed-off-by: Dudu Lu <phx0fer@gmail.com>
---
 net/bluetooth/hci_conn.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index e6393f17576b..6e96a8aeebd3 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1201,7 +1201,7 @@ void hci_conn_del(struct hci_conn *conn)
 			hdev->acl_cnt += conn->sent;
 		break;
 	case LE_LINK:
-		cancel_delayed_work(&conn->le_conn_timeout);
+		disable_delayed_work_sync(&conn->le_conn_timeout);
 
 		if (hdev->le_pkts) {
 			if (!hci_conn_num(hdev, LE_LINK) ||
-- 
2.39.3 (Apple Git-145)