Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()

[ Upstream commit c531e63871c0b50c8c4e62c048535a08886fba3e ]

Add missing call to 'l2cap_chan_unlock()' on receive error handling
path in 'l2cap_conless_channel()'.

Fixes: a24cce14 ("Bluetooth: Fix reference counting of global L2CAP channels")
Reported-by:  <syzbot+45ac74737e866894acb0@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=45ac74737e866894acb0


Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 64f4938368f4be563b7652d6b18d37b317913b47)
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>