The pointer 'conn' may be null. Before being used by
hci_connect_le_scan_cleanup(), The pointer 'conn' must be
checked whether it is null.
Fixes: 28a667c9c279 ("Bluetooth: advertisement handling in new connect
procedure")
Reported-by: Hulk Robot <hul...@huawei.com>
Signed-off-by: Wang Hai <wangha...@huawei.com>
---
net/bluetooth/hci_conn.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index d0c1024bf600..6ca402c90ee1 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -757,6 +757,8 @@ static void create_le_conn_complete(struct hci_dev *hdev,
u8 status, u16 opcode)
hci_dev_lock(hdev);
conn = hci_lookup_le_connect(hdev);
+ if (!conn)
+ goto done;
if (!status) {
hci_connect_le_scan_cleanup(conn);
@@ -766,9 +768,6 @@ static void create_le_conn_complete(struct hci_dev *hdev,
u8 status, u16 opcode)
bt_dev_err(hdev, "request failed to create LE connection: "
"status 0x%2.2x", status);
- if (!conn)
- goto done;
-
hci_le_conn_failed(conn, status);
done:
--
2.17.1
