The hci_unregister_dev() function fails to safely cancel the cmd_timer
and ncmd_timer before freeing the hci_dev structure. If an asynchronous
event or timeout occurs during device teardown, the timer callbacks
may execute after the device has been freed, leading to a KASAN
slab-use-after-free panic.

In v1, the timers were disabled too early in the teardown sequence,
which caused deadlocks in CI testing (mgmt-tester and mesh-tester)
because the HCI teardown process relies on these timers to safely
time out the HCI_OP_RESET command.

This patch adds cancel_delayed_work_sync() calls at the very end
of hci_unregister_dev() after all teardown procedures have completed,
guaranteeing the timers are fully flushed before the struct is freed.

Signed-off-by: Jordan Walters <jaggyaur@gmail.com>
---
 net/bluetooth/hci_core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 28d7929dc59..3db1b3738b5 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2698,6 +2698,9 @@ void hci_unregister_dev(struct hci_dev *hdev)
 		rfkill_unregister(hdev->rfkill);
 		rfkill_destroy(hdev->rfkill);
 	}
 
+	cancel_delayed_work_sync(&hdev->cmd_timer);
+	cancel_delayed_work_sync(&hdev->ncmd_timer);
+
 	hci_dev_put(hdev);
 }