[PATCH 2/2] Bluetooth: msft: free detached address filter on cancel

[Jiale Yao <yaojiale02@163.com>]

An address filter queued for addition can be detached from the MSFT
filter list and marked AF_STATE_REMOVING before its command-sync work
runs. If the queued entry is then cancelled, its NULL destroy callback
leaves the detached filter without an owner.

Install a destroy callback that frees a cancelled filter only when it
has reached AF_STATE_REMOVING. Filters that are still linked remain
owned by the normal close cleanup path.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 net/bluetooth/msft.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c
index d9dd722db3eb..b9f8f089cc72 100644
--- a/net/bluetooth/msft.c
+++ b/net/bluetooth/msft.c
@@ -928,6 +928,16 @@ static int msft_add_address_filter_sync(struct hci_dev *hdev, void *data)
 	return 0;
 }
 
+static void msft_add_address_filter_destroy(struct hci_dev *hdev, void *data,
+					    int err)
+{
+	struct msft_monitor_addr_filter_data *address_filter = data;
+
+	if (err == -ECANCELED &&
+	    address_filter->state == AF_STATE_REMOVING)
+		kfree(address_filter);
+}
+
 /* This function requires the caller holds msft->filter_lock */
 static struct msft_monitor_addr_filter_data *msft_add_address_filter
 		(struct hci_dev *hdev, u8 addr_type, bdaddr_t *bdaddr,
@@ -959,7 +969,7 @@ static struct msft_monitor_addr_filter_data *msft_add_address_filter
 	list_add_tail(&address_filter->list, &msft->address_filters);
 
 	err = hci_cmd_sync_queue(hdev, msft_add_address_filter_sync,
-				 address_filter, NULL);
+				 address_filter, msft_add_address_filter_destroy);
 	if (err < 0) {
 		bt_dev_err(hdev, "MSFT: Add address %pMR filter err", bdaddr);
 		list_del(&address_filter->list);
-- 
2.34.1