Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Write in hci_conn_drop (3)

[Edward Adam Davis]

#syz test

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index a9f5b1a68356..cbbb1ad3e78a 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -329,9 +329,11 @@ static void hci_cmd_sync_work(struct work_struct *work)
 			int err;
 
 			hci_req_sync_lock(hdev);
+			hci_dev_lock(hdev);
 			err = entry->func(hdev, entry->data);
 			if (entry->destroy)
 				entry->destroy(hdev, entry->data, err);
+			hci_dev_unlock(hdev);
 			hci_req_sync_unlock(hdev);
 		}