[PATCH v2] Bluetooth: hci_debugfs: serialize force_bredr_smp writes

[Cen Zhang <zzzccc427@gmail.com>]

force_bredr_smp_write() calls smp_force_bredr() without hci_dev_lock().
That helper checks HCI_FORCE_BREDR_SMP, updates hdev->smp_bredr_data,
and then toggles the force flag.

Two same-value writers can both pass the state check and run the same
enable or disable transition on one hdev. On the disable side, one writer
can clear hdev->smp_bredr_data while the other still observes the old
force flag and later passes NULL into smp_del_chan(). The double
transition can also leave the force flag out of sync with the requested
state.

Take hci_dev_lock() around smp_force_bredr() in the debugfs write path so
each request observes and applies one stable BR/EDR SMP transition.

Validation reproduced this kernel report:

  KASAN null-ptr-deref in smp_del_chan+0x31/0x90
  RIP: 0033:0x7faae680d340
  RIP: 0010:smp_del_chan+0x31/0x90 [bluetooth]
  Read of size 8
  Call Trace:
   dump_stack_lvl+0x66/0xa0
   kasan_report+0xe0/0x110
   smp_del_chan+0x31/0x90
   smp_force_bredr+0x69/0xc0
   trace_clock_x86_tsc+0x20/0x20
   srso_alias_return_thunk+0x5/0xfbef5
   lock_acquire+0xd0/0x300
   ksys_write+0xd2/0x170
   full_proxy_write+0x9e/0xd0
   vfs_write+0x1b0/0x810
   find_held_lock+0x2b/0x80
   do_user_addr_fault+0x65a/0x890
   rcu_is_watching+0x20/0x50
   do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)
   entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fixes: 300acfdec916 ("Bluetooth: Introduce force_bredr_smp debugfs option for testing")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---
v2:
- Reword commit message to avoid checkpatch's 75-character line warning.

 net/bluetooth/hci_debugfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c
index b7f682922a16..ff344564c923 100644
--- a/net/bluetooth/hci_debugfs.c
+++ b/net/bluetooth/hci_debugfs.c
@@ -520,7 +520,9 @@ static ssize_t force_bredr_smp_write(struct file *file,
 	if (err)
 		return err;
 
+	hci_dev_lock(hdev);
 	err = smp_force_bredr(hdev, enable);
+	hci_dev_unlock(hdev);
 	if (err)
 		return err;
 
-- 
2.43.0