The current code bt_hid_send_data() did not check whether its first
parameter *ch is NULL, which will cause a "Segmentation fault" when
*ch is NULL as ch->remote_mtu will be directly referenced later in
this function. E.g. when called by bt_hid_datain() and hid->interrupt
is NULL with "qemu-system-x86_64 ... \ -bt device:keyboard,vlan=3".

Thus add a judgement to avoid such error.

Signed-off-by: Fei Li <fli@suse.com>
---
 hw/bt/hid.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/bt/hid.c b/hw/bt/hid.c
index 056291f9b5..dfb0ea9c9b 100644
--- a/hw/bt/hid.c
+++ b/hw/bt/hid.c
@@ -174,6 +174,9 @@ static void bt_hid_send_data(struct bt_l2cap_conn_params_s *ch, int type,
     uint8_t *pkt, hdr = (BT_DATA << 4) | type;
     int plen;
 
+    if (!ch)
+        return;
+
     do {
         plen = MIN(len, ch->remote_mtu - 1);
         pkt = ch->sdu_out(ch, plen + 1);
-- 
2.13.6