[PATCH v1] Bluetooth: L2CAP: Reject mode changes on connected channels

[Siwei Zhang <oss@fourdim.xyz>]

Allowing mode changes on already-connected channel will
skip necessary initialization on the new mode, resulting
NULL ptr dereference.

Cc: stable@vger.kernel.org
Closes: https://sashiko.dev/#/patchset/20261007144717.3832330-1-oss%40fourdim.xyz
Fixes: f2fcfcd67025 ("Bluetooth: Add configuration support for ERTM and Streaming mode")
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
---
Please apply https://lore.kernel.org/linux-bluetooth/20261007144717.3832330-1-oss@fourdim.xyz/
as well, thank you.

 net/bluetooth/l2cap_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index cb4ec42f99e3..2cb3f59112f5 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3876,7 +3876,8 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
 		}
 	}
 
-	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
+	if ((chan->mode == L2CAP_MODE_BASIC || chan->state == BT_CONNECTED) &&
+	    chan->mode != rfc.mode)
 		return -ECONNREFUSED;
 
 	chan->mode = rfc.mode;
-- 
2.55.0