Bluetooth: Fix poll() misbehavior when using BT_DEFER_SETUP

When BT_DEFER_SETUP has been enabled on a Bluetooth socket it keeps
signaling POLLIN all the time. This is a wrong behavior. The POLLIN
should only be signaled if the client socket is in BT_CONNECT2 state
and the parent has been BT_DEFER_SETUP enabled.
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

net/bluetooth/af_bluetooth.c

@@ -270,12 +270,11 @@ static inline unsigned int bt_accept_poll(struct sock *parent)
 	struct list_head *p, *n;
 	struct sock *sk;
 
-	if (bt_sk(parent)->defer_setup)
-		return POLLIN | POLLRDNORM;
-
 	list_for_each_safe(p, n, &bt_sk(parent)->accept_q) {
 		sk = (struct sock *) list_entry(p, struct bt_sock, accept_q);
-		if (sk->sk_state == BT_CONNECTED)
+		if (sk->sk_state == BT_CONNECTED ||
+					(bt_sk(parent)->defer_setup &&
+						sk->sk_state == BT_CONNECT2))
 			return POLLIN | POLLRDNORM;
 	}