From: Eric Sesterhenn <snakebyte@gmx.de>
Date: Thu, 6 Apr 2006 05:28:14 +0000 (-0700)
Subject: [BLUETOOTH] sco: Possible double free.
X-Git-Tag: v2.6.17-rc2~291^2~27
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cdee5751bf91d02616aaf30a5affef56105e3b79;p=linux-2.6

[BLUETOOTH] sco: Possible double free.

this fixes coverity bug id #1068.
hci_send_sco() frees skb if (skb->len > hdev->sco_mtu).
Since it returns a negative error value only in this case, we
can directly return here.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 6b61323ce2..0c2d13ad69 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -255,7 +255,7 @@ static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
 	}
 
 	if ((err = hci_send_sco(conn->hcon, skb)) < 0)
-		goto fail;
+		return err;
 
 	return count;