When the connection is not in BT_CONNECTED state it was possible for code in hci_chan_modify() to attempt to access the hci_chan structure after it had already been deleted by hci_chan_put(). Change-Id: I5ae352ac12aa3b456e7bcf30633015d98b03e44b CRs-fixed: 319934 Signed-off-by: Peter Krystad <pkrystad@codeaurora.org>