Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}

stable inclusion
from stable-v5.10.178
commit d9ba36c22a7bb09d6bac4cc2f243eff05da53f43
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8D927

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d9ba36c22a7bb09d6bac4cc2f243eff05da53f43



--------------------------------

commit a2a9339e upstream.

Similar to commit d0be8347 ("Bluetooth: L2CAP: Fix use-after-free
caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.

Cc: stable@kernel.org
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Min Li <lm0963hack@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: sanglipeng <sanglipeng1@jd.com>