Bluetooth: Use locked l2cap_state_change()