L2CAP: Spec violation

[Sungwoo Kim]

Hello,

Our fuzzer found a BT spec violation, illegal state transition on L2cap.
Specifically, l2cap_chan::state is transitioned from BT_CONFIG to
BT_DISCONN by CONFIG_RSP by following trace:

l2cap_config_rsp l2cap_core.c:4498
l2cap_send_disconn_req l2cap_core.c:4585
l2cap_state_change l2cap_core.c:1618

According to the spec 5.3 vol.3 part A 6.1.4, CONFIG_RSP cannot cause
that transition, i.e., CONFIG -> DISCONN by CONFIG_RSP is illegal.
It'd be great if we could discuss.

Thanks,
Sungwoo.