Passive scanning is used to program the address of the peer to be
synchronized, so once HCI_EV_LE_PA_SYNC_ESTABLISHED is received it
needs to be updated after clearing HCI_PA_SYNC then call
hci_update_passive_scan_sync to return it to its original state.
Fixes: 6d0417e4e1cf ("Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
 
        hci_dev_lock(hdev);
 
-       hci_dev_clear_flag(hdev, HCI_PA_SYNC);
-
        if (!hci_conn_valid(hdev, conn))
                clear_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags);
 
                __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_CREATE_SYNC_CANCEL,
                                      0, NULL, HCI_CMD_TIMEOUT);
 
+       hci_dev_clear_flag(hdev, HCI_PA_SYNC);
+
+       /* Update passive scan since HCI_PA_SYNC flag has been cleared */
+       hci_update_passive_scan_sync(hdev);
+
        return err;
 }