Bluetooth: Host: Fix bt_l2cap_chan_ops.recv -EINPROGRESS

Fix discrepancy in reference management between calls to
`bt_l2cap_chan_ops.recv` when the application returns `-EINPROGRESS`.

There are two call sites, `l2cap_chan_le_recv_sdu` and
`l2cap_chan_le_recv`, that were inconsistent.

`l2cap_chan_le_recv_sdu` moves the reference, and this patch updates
`l2cap_chan_le_recv_sdu` to do the same.

This behavior is also now documented.

This bug has existed since the introduction of this feature in
3151d26.

Signed-off-by: Aleksander Wasaznik <[email protected]>

include/zephyr/bluetooth/l2cap.h

@@ -342,6 +342,9 @@ struct bt_l2cap_chan_ops {
 	 *  @param chan The channel receiving data.
 	 *  @param buf Buffer containing incoming data.
 	 *
+	 *  If the application returns -EINPROGRESS, the reference
+	 *  @p buf was moved.
+	 *
 	 *  @return 0 in case of success or negative value in case of error.
 	 *  @return -EINPROGRESS in case where user has to confirm once the data
 	 *                       has been processed by calling

subsys/bluetooth/host/l2cap.c

@@ -17,6 +17,7 @@
 #include <zephyr/sys/byteorder.h>
 #include <zephyr/sys/math_extras.h>
 #include <zephyr/sys/util.h>
+#include <zephyr/net/buf.h>
 
 #include <zephyr/bluetooth/hci.h>
 #include <zephyr/bluetooth/bluetooth.h>
@@ -2538,6 +2539,7 @@ static void l2cap_chan_le_recv_seg_direct(struct bt_l2cap_le_chan *chan, struct
 static void l2cap_chan_le_recv(struct bt_l2cap_le_chan *chan,
 			       struct net_buf *buf)
 {
+	struct net_buf *owned_ref;
 	uint16_t sdu_len;
 	int err;
 
@@ -2611,7 +2613,14 @@ static void l2cap_chan_le_recv(struct bt_l2cap_le_chan *chan,
 		return;
 	}
 
-	err = chan->chan.ops->recv(&chan->chan, buf);
+	owned_ref = net_buf_ref(buf);
+	err = chan->chan.ops->recv(&chan->chan, owned_ref);
+	if (err != -EINPROGRESS) {
+		net_buf_unref(owned_ref);
+		owned_ref = NULL;
+	}
+
+
 	if (err < 0) {
 		if (err != -EINPROGRESS) {
 			LOG_ERR("err %d", err);