[BLUETOOTH] sco: Possible double free.
authorEric Sesterhenn <snakebyte@gmx.de>
Thu, 6 Apr 2006 05:28:14 +0000 (22:28 -0700)
committerDavid S. Miller <davem@sunset.davemloft.net>
Mon, 10 Apr 2006 05:25:29 +0000 (22:25 -0700)
this fixes coverity bug id #1068.
hci_send_sco() frees skb if (skb->len > hdev->sco_mtu).
Since it returns a negative error value only in this case, we
can directly return here.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/bluetooth/sco.c

index 6b61323ce23cad772371657cf18833027f56d0f9..0c2d13ad69bbf0c799f8bff6fbc2e78ffcc22763 100644 (file)
@@ -255,7 +255,7 @@ static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
        }
 
        if ((err = hci_send_sco(conn->hcon, skb)) < 0)
-               goto fail;
+               return err;
 
        return count;