Merge branch 'bugfix/access_nullptr_when_ble_disconn' into 'master'

Bugfix/Fixed crash caused by accessing nullptr in `btm_acl_disconnected`

See merge request espressif/esp-idf!21877

components/bt/host/bluedroid/stack/btm/btm_acl.c

@@ -2657,29 +2657,37 @@ void btm_acl_connected(BD_ADDR bda, UINT16 handle, UINT8 link_type, UINT8 enc_mo
 *******************************************************************************/
 void btm_acl_disconnected(UINT16 handle, UINT8 reason)
 {
+    BOOLEAN need_report = TRUE;
+
 #if BTM_SCO_INCLUDED == TRUE
     /* If L2CAP doesn't know about it, send it to SCO */
     if (!l2c_link_hci_disc_comp (handle, reason)) {
         btm_sco_removed (handle, reason);
+        need_report = FALSE;
     }
 #else
-    /* Report BR/EDR ACL disconnection result to upper layer */
-    tACL_CONN *conn = btm_handle_to_acl(handle);
+    l2c_link_hci_disc_comp(handle, reason);
+#endif /* BTM_SCO_INCLUDED */
+
+    if (need_report) {
+        /* Report BR/EDR ACL disconnection result to upper layer */
+        tACL_CONN *conn = btm_handle_to_acl(handle);
+        if (conn) {
 #if BLE_INCLUDED == TRUE
-    if (conn->transport == BT_TRANSPORT_BR_EDR)
+            if (conn->transport == BT_TRANSPORT_BR_EDR)
 #endif
-    {
-        tBTM_ACL_LINK_STAT_EVENT_DATA evt_data = {
-            .event = BTM_ACL_DISCONN_CMPL_EVT,
-            .link_act.disconn_cmpl.reason = reason,
-            .link_act.disconn_cmpl.handle = handle,
-        };
-        bdcpy(evt_data.link_act.disconn_cmpl.bd_addr, conn->remote_addr);
-        btm_acl_link_stat_report(&evt_data);
+            {
+                tBTM_ACL_LINK_STAT_EVENT_DATA evt_data = {
+                    .event = BTM_ACL_DISCONN_CMPL_EVT,
+                    .link_act.disconn_cmpl.reason = reason,
+                    .link_act.disconn_cmpl.handle = handle,
+                };
+                bdcpy(evt_data.link_act.disconn_cmpl.bd_addr, conn->remote_addr);
+                btm_acl_link_stat_report(&evt_data);
+            }
+        }
     }
 
-    l2c_link_hci_disc_comp(handle, reason);
-#endif /* BTM_SCO_INCLUDED */
 #if (SMP_INCLUDED == TRUE)
     /* Notify security manager */
     btm_sec_disconnected(handle, reason);