[PATCH 0/2] Bluetooth: fix command-sync cancellation leaks

[Jiale Yao]

Command-sync cancellation releases the queue entry but relies on its
destroy callback to release callback data. Two Bluetooth paths leave
heap-backed callback data without an owner when their queued work is
cancelled.

The first patch releases an unlisted management pending command on
cancellation. The second adds ownership-aware cancellation cleanup for
an MSFT address filter that has already been detached from its tracking
list.

Jiale Yao (2):
  Bluetooth: MGMT: free remove monitor command on cancel
  Bluetooth: msft: free detached address filter on cancel

 net/bluetooth/mgmt.c |  4 +++-
 net/bluetooth/msft.c | 12 +++++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

-- 
2.34.1