Bluetooth: Fix EBUSY condition test in l2cap_chan_connect

The current test in l2cap_chan_connect is intended to protect against
multiple conflicting connect attempts. However, it assumes that there
will ever only be a single CID that is connected to, which is not true.
We do need to check for conflicts with connect attempts to the same
destination CID but this check is not in anyway specific to LE but can
be applied to BR/EDR as well.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

1 files changed, 4 insertions, 10 deletions

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 29398293d501..640423b4f411 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1811,16 +1811,10 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
                 goto done;
         }
 
-        if (hcon->type == LE_LINK) {
-                err = 0;
-
-                if (!list_empty(&conn->chan_l)) {
-                        err = -EBUSY;
-                        hci_conn_drop(hcon);
-                }
-
-                if (err)
-                        goto done;
+        if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
+                hci_conn_drop(hcon);
+                err = -EBUSY;
+                goto done;
         }
 
         /* Update source addr of the socket */