commit 9aedfa676b9fc573da30c90f291cdaf875ed1c9f
author Johan Hedberg <johan.hedberg@intel.com> Mon Jul 19 17:38:45 2021 +0300
committer Johan Hedberg <johan.hedberg@gmail.com> Wed Jul 21 10:23:10 2021 +0300
tree bdc5fe86f89fd9b70b08ae5d589e77e8a4ddc209
parent b676e6a62859ba750be3ea3d10c84810ae128637

Bluetooth: L2CAP: Fix CIDs in disconnect request

The destination and source CIDs were mixed up in the L2CAP
Disconnect request.

Fixes #36665

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

subsys/bluetooth/host/l2cap.c

diff --git a/subsys/bluetooth/host/l2cap.c b/subsys/bluetooth/host/l2cap.c
index fcf6421..a6f185f 100644
--- a/subsys/bluetooth/host/l2cap.c
+++ b/subsys/bluetooth/host/l2cap.c
@@ -2607,8 +2607,8 @@
 	}
 
 	req = net_buf_add(buf, sizeof(*req));
-	req->dcid = sys_cpu_to_le16(ch->rx.cid);
-	req->scid = sys_cpu_to_le16(ch->tx.cid);
+	req->dcid = sys_cpu_to_le16(ch->tx.cid);
+	req->scid = sys_cpu_to_le16(ch->rx.cid);
 
 	l2cap_chan_send_req(chan, buf, L2CAP_DISC_TIMEOUT);
 	bt_l2cap_chan_set_state(chan, BT_L2CAP_DISCONNECT);