Bluetooth: Serialize TX scheduling with teardown

The TX scheduler drops its RCU read lock before using the selected channel or connection. Teardown on the separate request workqueue can then free that object while transmission is still using it.

This series fixes two distinct lifetime bugs using the existing device mutex:

1. Protect channel selection, transmission and priority recalculation in the ACL and LE schedulers against channel deletion.
2. Protect connection selection and transmission in the SCO and ISO schedulers against connection teardown.

Please apply the patches in order. Patch 2 depends on the ACL/LE locking introduced by patch 1: it uses a lock-held SCO helper for their nested SCO calls, while direct SCO calls from the TX worker use a locking wrapper. This preserves packet scheduling order without recursively taking the device mutex. Timeout checks remain outside the critical sections.

The transmit path can sleep, so extending ordinary RCU across transmission is not a suitable substitute for the mutex.

Validation: rebuilt hci_core.o after each patch and completed a full kernel build with CONFIG_BT, CONFIG_BT_BREDR and CONFIG_BT_LE enabled. Both patches pass strict checkpatch and apply in order to the stated base. Runtime PoC replay and runtime lockdep testing have not been performed for this series.

Chengfeng Ye (2):
Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown

 net/bluetooth/hci_core.c | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

base-commit: 165768bb70265b5c38cf0b73fafd75be235f8b14

2.43.0