From: DoHyun Pyun <dh79.pyun@samsung.com>
Date: Thu, 4 Jul 2019 00:18:21 +0000 (+0900)
Subject: Bluetooth: Fix the potential crash issue
X-Git-Tag: accepted/tizen/unified/20190705.110629~3
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=09499eb15be25af1b0b59bdcdc5ceb2e6eda8585;p=platform%2Fkernel%2Flinux-rpi3.git

Bluetooth: Fix the potential crash issue

There is a logic error in the event function. We should
check the callback function's parameter before calling.

Change-Id: I06a4a8c50317e5ec4ae8fe35e4b788105e090196
Fixes: bde01c80dd51 ("Bluetooth: Set le data length command and event")
Signed-off-by: DoHyun Pyun <dh79.pyun@samsung.com>
---

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 7b699e2..de15177 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1765,11 +1765,11 @@ static void hci_le_data_length_changed_complete_evt(struct hci_dev *hdev,
 		conn->tx_time = le16_to_cpu(ev->tx_time);
 		conn->rx_len = le16_to_cpu(ev->rx_len);
 		conn->rx_time = le16_to_cpu(ev->rx_time);
-	}
 
-	mgmt_le_data_length_change_complete(hdev, &conn->dst,
+		mgmt_le_data_length_change_complete(hdev, &conn->dst,
 					    conn->tx_len, conn->tx_time,
 					    conn->rx_len, conn->rx_time);
+	}
 
 	hci_dev_unlock(hdev);
 }