1 files changed, 15 insertions, 7 deletions

diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index e0e0d09023b2..eb2b52484c70 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -697,9 +697,13 @@ static int rfcomm_tty_write_room(struct tty_struct *tty)
 
         BT_DBG("tty %p", tty);
 
+        if (!dev || !dev->dlc)
+                return 0;
+
         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
         if (room < 0)
                 room = 0;
+
         return room;
 }
 
@@ -915,12 +919,14 @@ static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        struct rfcomm_dlc *dlc = dev->dlc;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
-        if (!skb_queue_empty(&dlc->tx_queue))
-                return dlc->mtu;
+        if (!dev || !dev->dlc)
+                return 0;
+
+        if (!skb_queue_empty(&dev->dlc->tx_queue))
+                return dev->dlc->mtu;
 
         return 0;
 }
@@ -928,11 +934,12 @@ static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        if (!dev)
-                return;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
+        if (!dev || !dev->dlc)
+                return;
+
         skb_queue_purge(&dev->dlc->tx_queue);
 
         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
@@ -952,11 +959,12 @@ static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
 static void rfcomm_tty_hangup(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        if (!dev)
-                return;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
+        if (!dev)
+                return;
+
         rfcomm_tty_flush_buffer(tty);
 
         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))