diff options
| author | Eric Sesterhenn <snakebyte@gmx.de> | 2006-04-05 22:28:14 -0700 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2006-04-09 22:25:29 -0700 |
| commit | cdee5751bf91d02616aaf30a5affef56105e3b79 (patch) | |
| tree | 8a7d6f231dc9de03c7d9bb5b6623bd539900abce /net/bluetooth/sco.c | |
| parent | ad96b485b4224785bcca478cfba02d06c46ee575 (diff) | |
| download | linux-cdee5751bf91d02616aaf30a5affef56105e3b79.tar.gz linux-cdee5751bf91d02616aaf30a5affef56105e3b79.tar.bz2 linux-cdee5751bf91d02616aaf30a5affef56105e3b79.zip | |
[BLUETOOTH] sco: Possible double free.
this fixes coverity bug id #1068.
hci_send_sco() frees skb if (skb->len > hdev->sco_mtu).
Since it returns a negative error value only in this case, we
can directly return here.
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/bluetooth/sco.c')
| -rw-r--r-- | net/bluetooth/sco.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index 6b61323ce23c..0c2d13ad69bb 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -255,7 +255,7 @@ static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len) } if ((err = hci_send_sco(conn->hcon, skb)) < 0) - goto fail; + return err; return count; |