Bluetooth: Drop L2CAP chan reference if ERTM ack_timer fired
Bluetooth: Drop L2CAP chan reference if ERTM ack_timer fired

Reference counter was incremented when starting ack timer but
decremented only when clearing timer, not when timer fired.

Signed-off-by: Szymon Janc <db186c297188f7acbbdc9bbd6aff2f45665bb42d@tieto.com>
Acked-by: Marcel Holtmann <44592b4eea36663c86b994bb0ea99d15309c1c7d@holtmann.org>
Signed-off-by: Johan Hedberg <628991c7b0a19c384f9b99c21ec330ce952bb838@intel.com>

KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs