[Bluetooth] Fix uninitialized return value for RFCOMM sendmsg()

When calling send() with a zero length parameter on a RFCOMM socket
it returns a positive value. In this rare case the variable err is
used uninitialized and unfortunately its value is returned.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

1 files changed, 6 insertions, 3 deletions

diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 544d65b7baa7..cb7e855f0828 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -557,7 +557,6 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         struct sock *sk = sock->sk;
         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
         struct sk_buff *skb;
-        int err;
         int sent = 0;
 
         if (msg->msg_flags & MSG_OOB)
@@ -572,6 +571,7 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         while (len) {
                 size_t size = min_t(size_t, len, d->mtu);
+                int err;
                 
                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
                                 msg->msg_flags & MSG_DONTWAIT, &err);
@@ -582,13 +582,16 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
                 if (err) {
                         kfree_skb(skb);
-                        sent = err;
+                        if (sent == 0)
+                                sent = err;
                         break;
                 }
 
                 err = rfcomm_dlc_send(d, skb);
                 if (err < 0) {
                         kfree_skb(skb);
+                        if (sent == 0)
+                                sent = err;
                         break;
                 }
 
@@ -598,7 +601,7 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         release_sock(sk);
 
-        return sent ? sent : err;
+        return sent;
 }
 
 static long rfcomm_sock_data_wait(struct sock *sk, long timeo)