Bluetooth: hci_sync: cancel cmd_timer if hci_open failed

stable inclusion
from stable-v5.10.166
commit 1d580d3e1311c5d28f0f28137cbcb999e9d446d8
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7TH9O

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1d580d3e1311c5d28f0f28137cbcb999e9d446d8

--------------------------------

commit 97dfaf07 upstream.

If a command is already sent, we take care of freeing it, but we
also need to cancel the timeout as well.
Signed-off-by: NArchie Pusaka <apusaka@chromium.org>
Reviewed-by: NAbhishek Pandit-Subedi <abhishekpandit@google.com>
Signed-off-by: NLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: NFedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

net/bluetooth/hci_core.c

@@ -1623,6 +1623,7 @@ static int hci_dev_do_open(struct hci_dev *hdev)
 			hdev->flush(hdev);
 
 		if (hdev->sent_cmd) {
+			cancel_delayed_work_sync(&hdev->cmd_timer);
 			kfree_skb(hdev->sent_cmd);
 			hdev->sent_cmd = NULL;
 		}