Bluetooth: ISO: Move iso dereference after assertion

sjanc · jhedberg · commit d53a1659ef12 · 2025-11-13T23:14:34.000+02:00
Make sure assertion is true before dereferencing chan-&gt;iso. In extreme
case compiler could skip assert check (asume it is always false) if address
was already dereferenced.

Signed-off-by: Szymon Janc &lt;szymon.janc@codecoup.pl&gt;
diff --git a/subsys/bluetooth/host/iso.c b/subsys/bluetooth/host/iso.c
@@ -454,7 +454,7 @@ void bt_iso_connected(struct bt_conn *iso)
 
 static void bt_iso_chan_disconnected(struct bt_iso_chan *chan, uint8_t reason)
 {
-	const uint8_t conn_type = chan->iso->iso.info.type;
+	uint8_t conn_type;
 	struct net_buf *buf;
 
 	LOG_DBG("%p, reason 0x%02x", chan, reason);
@@ -478,6 +478,8 @@ static void bt_iso_chan_disconnected(struct bt_iso_chan *chan, uint8_t reason)
 		chan->ops->disconnected(chan, reason);
 	}
 
+	conn_type = chan->iso->iso.info.type;
+
 	/* The peripheral does not have the concept of a CIG, so once a CIS
 	 * disconnects it is completely freed by unref'ing it
 	 */

Original file line number	Diff line number	Diff line change
`@@ -454,7 +454,7 @@ void bt_iso_connected(struct bt_conn *iso)`
`454`	`454`
`455`	`455`	`static void bt_iso_chan_disconnected(struct bt_iso_chan *chan, uint8_t reason)`
`456`	`456`	`{`
`457`		`- const uint8_t conn_type = chan->iso->iso.info.type;`
	`457`	`+ uint8_t conn_type;`
`458`	`458`	`struct net_buf *buf;`
`459`	`459`
`460`	`460`	`LOG_DBG("%p, reason 0x%02x", chan, reason);`
`@@ -478,6 +478,8 @@ static void bt_iso_chan_disconnected(struct bt_iso_chan *chan, uint8_t reason)`
`478`	`478`	`chan->ops->disconnected(chan, reason);`
`479`	`479`	`}`
`480`	`480`
	`481`	`+ conn_type = chan->iso->iso.info.type;`
	`482`	`+`
`481`	`483`	`/* The peripheral does not have the concept of a CIG, so once a CIS`
`482`	`484`	`* disconnects it is completely freed by unref'ing it`
`483`	`485`	`*/`