From 91d3b3e0459487264db02cc0ba289c5b5397b6c6 Mon Sep 17 00:00:00 2001
From: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Date: Thu, 19 Jul 2012 17:03:43 +0300
Subject: [PATCH] --- yaml --- r: 321996 b: refs/heads/master c:
 d08fd0e712a834d4abb869c0215a702e290bc51e h: refs/heads/master v: v3

---
 [refs]                    | 2 +-
 trunk/net/bluetooth/smp.c | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index 8428c3d317df..3803e87a6ad1 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: c3e7c0d90b14a3e7ac091d24cef09efb516d587b
+refs/heads/master: d08fd0e712a834d4abb869c0215a702e290bc51e
diff --git a/trunk/net/bluetooth/smp.c b/trunk/net/bluetooth/smp.c
index 16ef0dc85a0a..901a616c8083 100644
--- a/trunk/net/bluetooth/smp.c
+++ b/trunk/net/bluetooth/smp.c
@@ -579,8 +579,11 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
 	if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
 		smp = smp_chan_create(conn);
+	else
+		smp = conn->smp_chan;
 
-	smp = conn->smp_chan;
+	if (!smp)
+		return SMP_UNSPECIFIED;
 
 	smp->preq[0] = SMP_CMD_PAIRING_REQ;
 	memcpy(&smp->preq[1], req, sizeof(*req));