Bluetooth: Fix CID initialization for fixed channels

Fixed channels have the same source and destination CID. Ensure that the
values get properly initialized when receiving incoming connections and
deriving values from the parent socket.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

2 files changed, 5 insertions, 2 deletions

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index e5c5c7427c41..cc340700573e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1462,8 +1462,6 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
         if (!chan)
                 goto clean;
 
-        chan->dcid = L2CAP_CID_ATT;
-
         bacpy(&chan->src, &hcon->src);
         bacpy(&chan->dst, &hcon->dst);
         chan->src_type = bdaddr_type(hcon, hcon->src_type);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 7ad346ea06ed..ae4f6b593fc0 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1470,6 +1470,11 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent)
                 chan->tx_credits = pchan->tx_credits;
                 chan->rx_credits = pchan->rx_credits;
 
+                if (chan->chan_type == L2CAP_CHAN_FIXED) {
+                        chan->scid = pchan->scid;
+                        chan->dcid = pchan->scid;
+                }
+
                 security_sk_clone(parent, sk);
         } else {
                 switch (sk->sk_type) {