Bluetooth: ISO: Fix issue with BIS tx_complete

[Thalley]

BIS termination as broadcaster is handled different than ACL and CIS, and in rare chances the
tx_complete for BIS may not have been completed in the system workqueue before iso_new was called for the same bt_conn struct (e.g. via bt_iso_cig_create), which would perform

k_work_init(&conn->tx_complete_work, tx_complete_work);

but where conn->tx_complete_work still existed in
the system workqueue, which would cause the list
of pending items on the system workqueue to be removed as the next pointer would be NULL.

This also adds an assert in bt_conn_new to prevent this issue from appearing again.

[Thalley]

The assert from this PR may be superseded by #93279

[cvinayak]

@PavelVPV FYI, as this issue concerns the way Host uses system workqueue, potentially causing issues to other users of system work queue.

[PavelVPV]

IIRC we don't need to update copyright year.

[Thalley]

I don't we ever managed to write and guidelines on this :D I usually just update them when I remember them, but I can omit it if you prefer

[PavelVPV]

Fine by me. I remember getting such comment long time ago, but can't find it now.

[PavelVPV]

@PavelVPV FYI, as this issue concerns the way Host uses system workqueue, potentially causing issues to other users of system work queue.

Perhaps, all work items should be moved below ref in bt_conn and initialized just once.

[Thalley]

I moved the assert to bt_conn_unref when a bt_conn is unreffed, as that's really where all pending TX should have been flushed

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull Request Overview

This PR fixes a race condition in Bluetooth ISO (Isochronous) connections where BIS (Broadcast Isochronous Stream) termination could cause work queue corruption. The issue occurred when tx_complete_work was reinitialized while still pending in the system workqueue, potentially corrupting the queue's linked list structure.

Key changes:

• Add explicit tx_complete cleanup for BIS broadcaster termination
• Add assertion to detect work queue corruption during connection deallocation
• Add mock functions for k_work_busy_get to support testing

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
subsys/bluetooth/host/iso.c	Adds explicit bt_conn_tx_notify call for BIS broadcaster disconnection to flush pending tx_complete work
subsys/bluetooth/host/conn.c	Adds assertion to detect pending tx_complete_work during connection deallocation
tests/bluetooth/host/conn/mocks/kernel.h	Declares mock function for k_work_busy_get
tests/bluetooth/host/conn/mocks/kernel.c	Defines mock function for k_work_busy_get

[Copilot]

Setting conn to NULL after the assertion will cause the assertion to access a NULL pointer. The conn = NULL assignment should remain after the assertion, but the assertion should be moved before this line or use a different approach to access the work structure.