Bluetooth: Fix crash when ioctl(HCIUARTSETPROTO) fails

If the fail happens the HCI del_timer may timeout after the the hci dev
unregister. This lead to a kernel crash.

Reported-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

1 files changed, 2 insertions, 0 deletions

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 173bebd42825..c01415bc8946 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1199,6 +1199,8 @@ int hci_unregister_dev(struct hci_dev *hdev)
 
         hci_unregister_sysfs(hdev);
 
+        hci_del_off_timer(hdev);
+
         destroy_workqueue(hdev->workqueue);
 
         hci_dev_lock_bh(hdev);