[PATCH] Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

[Dudu Lu <phx0fer@gmail.com>]

l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without first acquiring
the channel lock or holding a reference on the channel. All other call
sites of l2cap_chan_del() in l2cap_core.c (e.g., l2cap_disconnect_req,
l2cap_ecred_conn_rsp) properly hold the channel lock and a reference.

Without the lock, concurrent operations on the same channel can lead to
list corruption or use-after-free. Fix by adding l2cap_chan_hold +
l2cap_chan_lock before the deletion and the corresponding unlock + put
after, matching the established pattern.

Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add L2CAP_ECRED_RECONF support")
Signed-off-by: Dudu Lu <phx0fer@gmail.com>
---
 net/bluetooth/l2cap_core.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index XXXXXXX..XXXXXXX 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5472,7 +5472,15 @@ static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
 		if (chan->ident != cmd->ident)
 			continue;

-		l2cap_chan_del(chan, ECONNRESET);
+		l2cap_chan_hold(chan);
+		l2cap_chan_lock(chan);
+
+		l2cap_chan_del(chan, ECONNRESET);
+
+		l2cap_chan_unlock(chan);
+		l2cap_chan_put(chan);
 	}

 	return 0;