[PATCH v1] bluetooth: hci_core: Fix use-after-free in vhci_flush().

Subject: [PATCH v1] bluetooth: hci_core: Fix use-after-free in vhci_flush().
From: Kuniyuki Iwashima <kuni1840@xxxxxxxxx>
Date: Fri, 13 Jun 2025 16:02:21 -0700
Authentication-results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NHLs2N2l"
Authentication-results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.172
Authentication-results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com
Authentication-results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com
Cc: David Rheinsberg <david@xxxxxxxxxxxx>, Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>, Kuniyuki Iwashima <kuni1840@xxxxxxxxx>, linux-bluetooth@xxxxxxxxxxxxxxx, syzbot+2faa4825e556199361f9@xxxxxxxxxxxxxxxxxxxxxxxxx

From: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>

syzbot reported use-after-free in vhci_flush() without repro. [0]

Follow-Ups:
- Re: [PATCH v1] bluetooth: hci_core: Fix use-after-free in vhci_flush().
  - From: Paul Menzel
- RE: [v1] bluetooth: hci_core: Fix use-after-free in vhci_flush().
  - From: bluez . test . bot