bluetooth: l2cap_br: l2cap channel used wrong cid when removing

LuoZhongYao · jhedberg · commit d1aa80c04946 · 2019-12-11T11:34:43.000+02:00
In bt_l2cap_br_chan, rx.cid is the local cid and tx.cid is the
remote cid. According to Core-5.0 Vol3.Part A 4.6-4.7,
l2cap_br_remove_tx_cid should be searched using tx.cid

Signed-off-by: ZhongYao Luo &lt;LuoZhongYao@gmail.com&gt;
diff --git a/subsys/bluetooth/host/l2cap_br.c b/subsys/bluetooth/host/l2cap_br.c
@@ -1049,7 +1049,7 @@ static struct bt_l2cap_br_chan *l2cap_br_remove_tx_cid(struct bt_conn *conn,
 	}
 
 	SYS_SLIST_FOR_EACH_CONTAINER(&conn->channels, chan, node) {
-		if (BR_CHAN(chan)->rx.cid == cid) {
+		if (BR_CHAN(chan)->tx.cid == cid) {
 			sys_slist_remove(&conn->channels, prev, &chan->node);
 			return BR_CHAN(chan);
 		}

Original file line number	Diff line number	Diff line change
`@@ -1049,7 +1049,7 @@ static struct bt_l2cap_br_chan l2cap_br_remove_tx_cid(struct bt_conn conn,`
`1049`	`1049`	`}`
`1050`	`1050`
`1051`	`1051`	`SYS_SLIST_FOR_EACH_CONTAINER(&conn->channels, chan, node) {`
`1052`		`- if (BR_CHAN(chan)->rx.cid == cid) {`
	`1052`	`+ if (BR_CHAN(chan)->tx.cid == cid) {`
`1053`	`1053`	`sys_slist_remove(&conn->channels, prev, &chan->node);`
`1054`	`1054`	`return BR_CHAN(chan);`
`1055`	`1055`	`}`