[PATCH net 0/2] Bluetooth: Serialize TX scheduling with teardown

[Chengfeng Ye <nicoyip.dev@gmail.com>]

The TX scheduler drops its RCU read lock before using the selected channel
or connection. Teardown on the separate request workqueue can then free
that object while transmission is still using it.

This series fixes two distinct lifetime bugs using the existing device
mutex:

  1. Protect channel selection, transmission and priority recalculation
     in the ACL and LE schedulers against channel deletion.
  2. Protect connection selection and transmission in the SCO and ISO
     schedulers against connection teardown.

Please apply the patches in order. Patch 2 depends on the ACL/LE locking
introduced by patch 1: it uses a lock-held SCO helper for their nested SCO
calls, while direct SCO calls from the TX worker use a locking wrapper.
This preserves packet scheduling order without recursively taking the
device mutex. Timeout checks remain outside the critical sections.

The transmit path can sleep, so extending ordinary RCU across transmission
is not a suitable substitute for the mutex.

Validation: rebuilt hci_core.o after each patch and completed a full kernel
build with CONFIG_BT, CONFIG_BT_BREDR and CONFIG_BT_LE enabled. Both patches
pass strict checkpatch and apply in order to the stated base. Runtime PoC
replay and runtime lockdep testing have not been performed for this series.

Chengfeng Ye (2):
  Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
  Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown

 net/bluetooth/hci_core.c | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)


base-commit: 165768bb70265b5c38cf0b73fafd75be235f8b14
-- 
2.43.0