Re: [PATCH] Bluetooth: fix use-after-free in hci_conn_drop

[kawada]

Apologies for the top-posting.

> Better not before spotting the reason why conn->refcnt
> failed to make the entry->destroy callback safe.

hci_conn_hold() increments conn->refcnt, but the actual
freeing of conn is done by put_device() called from
hci_conn_del(). hci_conn_del() does not check conn->refcnt
at all, so the hold/drop refcount cannot prevent the UAF
in entry->destroy callbacks.