Bluetooth: Fix missing channel unlock in l2cap_le_credits
authorMartin Townsend <mtownsend1973@gmail.com>
Mon, 13 Oct 2014 18:24:45 +0000 (19:24 +0100)
committerMarcel Holtmann <marcel@holtmann.org>
Sat, 25 Oct 2014 05:56:25 +0000 (07:56 +0200)
In the error case where credits is greater than max_credits there
is a missing l2cap_chan_unlock before returning.

Signed-off-by: Martin Townsend <mtownsend1973@gmail.com>
Tested-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
net/bluetooth/l2cap_core.c

index 2ff5591bee97d3336787766e1b3c246afe06dfce..d46c5127f6c3a47bc9cc2015781c7d92f2ae90ec 100644 (file)
@@ -5492,6 +5492,7 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
        if (credits > max_credits) {
                BT_ERR("LE credits overflow");
                l2cap_send_disconn_req(chan, ECONNRESET);
+               l2cap_chan_unlock(chan);
 
                /* Return 0 so that we don't trigger an unnecessary
                 * command reject packet.