Bluetooth: Fix dereference after NULL check

Move code dereferencing possible NULL pointer to the check branch.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

1 files changed, 6 insertions, 5 deletions

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 2542abd3336f..a71c4089d175 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -382,13 +382,14 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
                 }
 
                 memset(&sec, 0, sizeof(sec));
-                if (chan->conn)
+                if (chan->conn) {
                         sec.level = chan->conn->hcon->sec_level;
-                else
-                        sec.level = chan->sec_level;
 
-                if (sk->sk_state == BT_CONNECTED)
-                        sec.key_size = chan->conn->hcon->enc_key_size;
+                        if (sk->sk_state == BT_CONNECTED)
+                                sec.key_size = chan->conn->hcon->enc_key_size;
+                } else {
+                        sec.level = chan->sec_level;
+                }
 
                 len = min_t(unsigned int, len, sizeof(sec));
                 if (copy_to_user(optval, (char *) &sec, len))