Bluetooth: Fix sending incorrect LE CoC PDU in BT_CONNECT2 state

For LE CoC L2CAP servers we don't do security level elevation during the
BT_CONNECT2 state (instead LE CoC simply sends an immediate error
response if the security level isn't high enough). Therefore if we get a
security level change while an LE CoC channel is in the BT_CONNECT2
state we should simply do nothing.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 52e1871d63346ecca65a3f8caccea442460c811e..76045497eaa144a154851069bcfcd18d340b9444 100644 (file)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7332,7 +7332,8 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                l2cap_start_connection(chan);
                        else
                                __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
-               } else if (chan->state == BT_CONNECT2) {
+               } else if (chan->state == BT_CONNECT2 &&
+                          chan->mode != L2CAP_MODE_LE_FLOWCTL) {
                        struct l2cap_conn_rsp rsp;
                        __u16 res, stat;