[nrf fromlist] Bluetooth: L2CAP: Fix missing net_buf_unref()

In case of non-recoverable errors (e.g. the connection breaks while
transmitting), the l2cap_chan_tx_process deques the net_buf but does
not unreference it. As this is inside a work queue thread, the sending
thread gets no information on this error, relying on the tx_process to
ultimately free the buffer.

Upstream PR: zephyrproject-rtos/zephyr#36031

Signed-off-by: Patrick Rathje <[email protected]>

Author: prathje

subsys/bluetooth/host/l2cap.c

@@ -872,6 +872,8 @@ static void l2cap_chan_tx_process(struct k_work *work)
 		if (sent < 0) {
 			if (sent == -EAGAIN) {
 				ch->tx_buf = buf;
+			} else {
+				net_buf_unref(buf);
 			}
 			break;
 		}