[PATCH v12 1/2] Bluetooth: L2CAP: Restrict LE credits to connected CoCs

[Kyle Pepper <cochcoder@proton.me>]

Do not let credit indications change fixed channels or complete pending
connection setup. Validate the channel state and mode before accounting
credits, checking overflow or invoking its resume callback.

Fixes: fad5fc89594d ("Bluetooth: Add LE flow control discipline")
Assisted-by: LLM
Signed-off-by: Kyle Pepper <cochcoder@proton.me>
---
Changes in v12:
- Reject the deferred ECRED batch when an accepted child closes before
  the connection response; close all siblings instead of disconnecting early.
- Patch 1 is unchanged.

Previous v11 (no cover letter):
https://lore.kernel.org/linux-bluetooth/4278a9caf4dc8e949092452c141a5be465ec77e1.1794550328.git.github.filter194@slmail.me/

Review:
https://sashiko.dev/#/patchset/4278a9caf4dc8e949092452c141a5be465ec77e1.1794550328.git.github.filter194%40slmail.me

 net/bluetooth/l2cap_core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 09ff32394..4e8aec98e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5464,6 +5464,11 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
 
 	l2cap_chan_lock(chan);
 
+	if (chan->state != BT_CONNECTED ||
+	    (chan->mode != L2CAP_MODE_LE_FLOWCTL &&
+	     chan->mode != L2CAP_MODE_EXT_FLOWCTL))
+		goto unlock;
+
 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
 	if (credits > max_credits) {
 		BT_ERR("LE credits overflow");

base-commit: da3cc02587c629420603df4395179ec82955c941