[PATCH v2] Bluetooth: hci_core: Fix use-after-free in vhci_flush()

Subject: [PATCH v2] Bluetooth: hci_core: Fix use-after-free in vhci_flush()
From: Kuniyuki Iwashima <kuni1840@xxxxxxxxx>
Date: Mon, 16 Jun 2025 10:37:58 -0700
Authentication-results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QMRVUl1B"
Authentication-results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.169
Authentication-results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com
Authentication-results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com
Cc: David Rheinsberg <david@xxxxxxxxxxxx>, Paul Menzel <pmenzel@xxxxxxxxxxxxx>, Pauli Virtanen <pav@xxxxxx>, Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>, Kuniyuki Iwashima <kuni1840@xxxxxxxxx>, linux-bluetooth@xxxxxxxxxxxxxxx, syzbot+2faa4825e556199361f9@xxxxxxxxxxxxxxxxxxxxxxxxx

From: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>

syzbot reported use-after-free in vhci_flush() without repro. [0]

Follow-Ups:
- Re: [PATCH v2] Bluetooth: hci_core: Fix use-after-free in vhci_flush()
  - From: Pauli Virtanen
- RE: [v2] Bluetooth: hci_core: Fix use-after-free in vhci_flush()
  - From: bluez . test . bot