Root Cause Analysis
1. Components and Locks Involved
2. The Lock Dependency Cycle (ABBA Inversion)
Order 1: &hdev->lock $\rightarrow$ &hdev->cmd_sync_work_lock
Throughout net/bluetooth/mgmt.c and net/bluetooth/hci_event.c, operations acquire hci_dev_lock(hdev) before scheduling synchronous HCI commands:
Order 2: &hdev->cmd_sync_work_lock $\rightarrow$ &hdev->lock
During device deregistration or command cancellation (hci_unregister_dev() $\rightarrow$ hci_cmd_sync_clear(), net/bluetooth/hci_sync.c:682):
void hci_cmd_sync_clear(struct hci_dev *hdev)
{
...
mutex_lock(&hdev->cmd_sync_work_lock);
list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list)
_hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED);
mutex_unlock(&hdev->cmd_sync_work_lock);
}
_hci_cmd_sync_cancel_entry() calls the entry's destroy callback while &hdev->cmd_sync_work_lock is held:
static void _hci_cmd_sync_cancel_entry(struct hci_dev *hdev,
struct hci_cmd_sync_work_entry *entry,
int err)
{
if (entry->destroy)
entry->destroy(hdev, entry->data, err);
list_del(&entry->list);
kfree(entry);
}
When entry->destroy is add_ext_adv_params_complete() (or similar MGMT completion handlers such as add_advertising_complete()), it begins by acquiring hci_dev_lock(hdev) (net/bluetooth/mgmt.c:9253) to clean up advertising instances (hci_find_adv_instance, hci_remove_adv_instance).
3. Invariant Violation and Mechanism
Notice the contrast with standard worker execution in hci_cmd_sync_work() (net/bluetooth/hci_sync.c:321-342), where cmd_sync_work_lock is held only to detach entry from hdev->cmd_sync_work_list via list_del(&entry->list) and dropped before executing entry->func and entry->destroy.
In hci_cmd_sync_clear() (as well as _hci_cmd_sync_cancel_entry() and hci_cmd_sync_dequeue()), entry->destroy is invoked inside the critical section protected by cmd_sync_work_lock. Because callbacks can validly manage device resources protected by hdev->lock, invoking entry->destroy under cmd_sync_work_lock violates the established locking hierarchy and triggers the reported lockdep warning / circular deadlock.