Bluetooth: Fix unset of SrejActioned flag

SrejActioned  is a flag that when set prevents local side to retransmit a
I-frame(the data frame) already retransmitted. The local entity can
retransmit again only when it receives a SREJ frame with the F-bit set.
SREJ frame - Selective Reject frame  - is sent when an entity wants the
retransmission of a specific I-frame that was lost or corrupted.
This bug can put ERTM in an unknown state once the entity can't
retransmit.
A frame with the Final bit set is expected when the local side sends a
frame with the Poll bit set due to a local busy condition or a
retransmission timer expired. (Receipt of P-bit shall always be replied by
a frame with the F-bit set).
pi->conn_state keeps informations about many ERTM flags including
SrejActioned.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

1 files changed, 1 insertions, 1 deletions

diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index dfd0327cf8da..2d5d37545b10 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -3443,7 +3443,7 @@ static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, str
                 } else if (rx_control & L2CAP_CTRL_FINAL) {
                         if ((pi->conn_state & L2CAP_CONN_SREJ_ACT) &&
                                         pi->srej_save_reqseq == tx_seq)
-                                pi->srej_save_reqseq &= ~L2CAP_CONN_SREJ_ACT;
+                                pi->conn_state &= ~L2CAP_CONN_SREJ_ACT;
                         else
                                 l2cap_retransmit_frame(sk, tx_seq);
                 }