[PATCH v11 1/2] Bluetooth: L2CAP: Restrict LE credits to connected CoCs

[Kyle Pepper]

Do not let credit indications change fixed channels or complete pending
connection setup. Validate the channel state and mode before accounting
credits, checking overflow or invoking its resume callback.

Fixes: fad5fc89594d ("Bluetooth: Add LE flow control discipline")
Assisted-by: LLM
Signed-off-by: Kyle Pepper <cochcoder@xxxxxxxxx>
---
Changes in v11:
- Purge retained deferred CoC data before incomplete-configuration teardown.
- Clear pending work flags on close and recheck channel state in the worker.
- Return EBUSY for overlapping SMP/encryption requests, including key
  distribution; restore pending_sec_level when rejecting an idle request.
- Complete ECRED child cleanup and propagate deferred security rejection.
- Preserve ordinary accept/close behavior and socket/SMP lock ordering.

Previous v10 (this series has no cover letter):
https://lore.kernel.org/linux-bluetooth/20261113030556.75484-1-cochcoder@xxxxxxxxx/

 net/bluetooth/l2cap_core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 09ff32394..4e8aec98e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5464,6 +5464,11 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
 
 	l2cap_chan_lock(chan);
 
+	if (chan->state != BT_CONNECTED ||
+	    (chan->mode != L2CAP_MODE_LE_FLOWCTL &&
+	     chan->mode != L2CAP_MODE_EXT_FLOWCTL))
+		goto unlock;
+
 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
 	if (credits > max_credits) {
 		BT_ERR("LE credits overflow");

base-commit: da3cc02587c629420603df4395179ec82955c941