bluetooth hci_ldisc ProtoInit Deref

Vulnerability analysis

The root cause is that when hci_register_dev() fails inside hci_uart_register_dev(), the HCI_UART_PROTO_INIT flag is not cleared before hu->proto->close(hu) is called and hu->hdev is set to NULL. Because HCI_UART_PROTO_INIT remains set, concurrent UART receive activity (hci_uart_tty_receive()) can still enter the protocol-specific recv handler after resources have been freed, leading to NULL pointer dereference or use-after-free on the freed hdev or protocol state. The fix acquires a percpu write lock before clearing HCI_UART_PROTO_INIT, ensuring all active readers have completed and no new reader can enter the recv path before the cleanup proceeds. This is a local race condition requiring a Bluetooth UART device and a specific failure path during initialization, making it High complexity to trigger reliably.