From: Archie Pusaka apusaka@chromium.org

commit 97dfaf073f5881c624856ef293be307b6166115c upstream.

If a command is already sent, we take care of freeing it, but we also need to cancel the timeout as well.

Signed-off-by: Archie Pusaka apusaka@chromium.org Reviewed-by: Abhishek Pandit-Subedi abhishekpandit@google.com Signed-off-by: Luiz Augusto von Dentz luiz.von.dentz@intel.com Signed-off-by: Fedor Pchelkin pchelkin@ispras.ru --- net/bluetooth/hci_core.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index a41b4dcf1a7a..cabe8eb4c14f 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -1632,6 +1632,7 @@ static int hci_dev_do_open(struct hci_dev *hdev) hdev->flush(hdev);

if (hdev->sent_cmd) { + cancel_delayed_work_sync(&hdev->cmd_timer); kfree_skb(hdev->sent_cmd); hdev->sent_cmd = NULL; }