From: Martin Townsend <mtownsend1973@gmail.com>
Date: Mon, 13 Oct 2014 18:24:45 +0000 (+0100)
Subject: Bluetooth: Fix missing channel unlock in l2cap_le_credits
X-Git-Tag: v3.19-rc1~118^2~234^2~3^2~108
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ee93053d569b8b56e09a278fc9c41b7adf070a96;p=thirdparty%2Fkernel%2Flinux.git

Bluetooth: Fix missing channel unlock in l2cap_le_credits

In the error case where credits is greater than max_credits there
is a missing l2cap_chan_unlock before returning.

Signed-off-by: Martin Townsend <mtownsend1973@gmail.com>
Tested-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
---

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 2ff5591bee97d..d46c5127f6c3a 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5492,6 +5492,7 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
 	if (credits > max_credits) {
 		BT_ERR("LE credits overflow");
 		l2cap_send_disconn_req(chan, ECONNRESET);
+		l2cap_chan_unlock(chan);
 
 		/* Return 0 so that we don't trigger an unnecessary
 		 * command reject packet.