diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 83b622a42811..70ad30b091e4 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -4480,11 +4480,11 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn, lockdep_assert_held(&chan->conn->lock); - /* Only accept a response to a connection request we sent and that - * is still outstanding. A channel waiting in BT_CONNECT for security - * or the feature mask has not sent one yet. + /* Only accept a response matching a connection request we sent and + * that is still outstanding. A channel waiting in BT_CONNECT for + * security or the feature mask has not sent one yet. */ - if (!l2cap_chan_connect_pending(chan)) + if (!l2cap_chan_connect_pending(chan) || chan->ident != cmd->ident) goto done; switch (result) {