Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4d6a2188bd456969f52c03edf1988de90f08d9f5
Commit:     4d6a2188bd456969f52c03edf1988de90f08d9f5
Parent:     b6e557fbf1dbba8cfa667a25503e5dbd0e9330b7
Author:     Marcel Holtmann <[EMAIL PROTECTED]>
AuthorDate: Mon Jan 8 02:16:31 2007 +0100
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Tue Jan 9 00:29:55 2007 -0800

    [Bluetooth] Fix uninitialized return value for RFCOMM sendmsg()
    
    When calling send() with a zero length parameter on a RFCOMM socket
    it returns a positive value. In this rare case the variable err is
    used uninitialized and unfortunately its value is returned.
    
    Signed-off-by: Marcel Holtmann <[EMAIL PROTECTED]>
---
 net/bluetooth/rfcomm/sock.c |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 544d65b..cb7e855 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -557,7 +557,6 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct 
socket *sock,
        struct sock *sk = sock->sk;
        struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
        struct sk_buff *skb;
-       int err;
        int sent = 0;
 
        if (msg->msg_flags & MSG_OOB)
@@ -572,6 +571,7 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct 
socket *sock,
 
        while (len) {
                size_t size = min_t(size_t, len, d->mtu);
+               int err;
                
                skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
                                msg->msg_flags & MSG_DONTWAIT, &err);
@@ -582,13 +582,16 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct 
socket *sock,
                err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
                if (err) {
                        kfree_skb(skb);
-                       sent = err;
+                       if (sent == 0)
+                               sent = err;
                        break;
                }
 
                err = rfcomm_dlc_send(d, skb);
                if (err < 0) {
                        kfree_skb(skb);
+                       if (sent == 0)
+                               sent = err;
                        break;
                }
 
@@ -598,7 +601,7 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct 
socket *sock,
 
        release_sock(sk);
 
-       return sent ? sent : err;
+       return sent;
 }
 
 static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to