AZL-85914

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hcisync: annotate data-races around hdev->reqstatus

_hcicmdsyncsk() sets hdev->reqstatus under hdev->reqlock:

hdev->req_status = HCI_REQ_PEND;

However, several other functions read or write hdev->req_status without holding any lock:

• hcisendcmdsync() reads reqstatus in hcicmdwork (workqueue)
• hcicmdsync_complete() reads/writes from HCI event completion
• hcicmdsynccancel() / hcicmdsynccancel_sync() read/write
• hciabortconn() reads in connection abort path

Since _hcicmdsyncsk() runs on hdev->reqworkqueue while hcisendcmdsync() runs on hdev->workqueue, these are different workqueues that can execute concurrently on different CPUs. The plain C accesses constitute a data race.

Add READONCE()/WRITEONCE() annotations on all concurrent accesses to hdev->reqstatus to prevent potential compiler optimizations that could affect correctness (e.g., load fusing in the waitevent condition or store reordering).