Check startup_future before using it

event_finish_startup and startup_timer_expired can race, leading one of
them to try to use startup_future when it is NULL.

Check startup_future still exists before using it.

Bug: 112114060
Test: Use Bluetooth
Change-Id: I018d45f070b3f931c1114abf0471b6ea1d524f2a

diff --git a/hci/src/hci_layer.cc b/hci/src/hci_layer.cc
index aa012d6..00348c2 100644 (file)
--- a/hci/src/hci_layer.cc
+++ b/hci/src/hci_layer.cc
@@ -342,6 +342,9 @@ static void event_finish_startup(UNUSED_ATTR void* context) {
   std::lock_guard<std::recursive_timed_mutex> lock(
       commands_pending_response_mutex);
   alarm_cancel(startup_timer);
+  if (!startup_future) {
+    return;
+  }
   future_ready(startup_future, FUTURE_SUCCESS);
   startup_future = NULL;
 }
@@ -358,9 +361,11 @@ static void startup_timer_expired(UNUSED_ATTR void* context) {
     // hence abort.
     abort();
   }
+  if (!startup_future) {
+    return;
+  }
   future_ready(startup_future, FUTURE_FAIL);
   startup_future = NULL;
-  lock.unlock();
 }
 
 // Command/packet transmitting functions