function l2cap_br_conn_req in /subsys/bluetooth/host/l2cap_br.c references uninitialized pointer

[zephyrbot]

Reported by David Kinder:

uninitialized pointer read in function l2cap_br_conn_req in /subsys/bluetooth/host/l2cap_br.c

BR/EDR (aka Bluetooth Classic) is still a work in progress and we don't have any real target hardware for it yet (besides qemu).

(Imported from Jira ZEP-1405)

[zephyrbot]

by Johan Hedberg:

This seems to be a regression from the following patch:

commit 941104a
Author: Arkadiusz Lichwa arkadiusz.lichwa@tieto.com
Date: Thu Oct 6 14:02:17 2016 +0200

Bluetooth: L2CAP: Refactor BR/EDR connection request handler

[zephyrbot]

by Johan Hedberg:

Also, unlike the description, this has nothing to do with the IP stack.

Arek, in case you don't have access to the coverity report, the issue is that there are several goto's to the 'done' label where 'chan' is uninitialized.

[zephyrbot]

by Arkadiusz Lichwa:

allright, will check that

[zephyrbot]

by Mark Linkmeyer:

Correcting the priority field

[zephyrbot]

by Andrei Laperie:

low pri as that's BR-EDR -related

[zephyrbot]

by Johan Hedberg:

This was already fixed by:

commit ba2adb7
Author: Szymon Janc szymon.janc@codecoup.pl
Date: Thu Dec 22 19:48:08 2016 +0100

Bluetooth: L2CAP: Fix use of uninitializer pointer

That commit had a reference to this Jira item, so not sure why it didn't show up here.