nimble/ll: Fix NULL pointer dereference on conn init cancel
If connection was cancelled before isr_end we just set LL back to
standby and bail out.
@@ -3030,15 +3030,18 @@ ble_ll_init_rx_isr_end(uint8_t *rxbuf, uint8_t crcok,
/* Get connection state machine to use if connection to be established */
connsm = g_ble_ll_conn_create_sm;
+ /* This could happen if connection init was cancelled while isr end was
+ * already pending
+ */
+ if (!connsm) {
+ ble_ll_state_set(BLE_LL_STATE_STANDBY);
+ return -1;
+ }
rc = -1;
pdu_type = rxbuf[0] & BLE_ADV_PDU_HDR_TYPE_MASK;
pyld_len = rxbuf[1];
- if (!connsm) {
- goto init_rx_isr_exit;
- }
-
#if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
scansm = connsm->scansm;
if (scansm->cur_aux_data) {
