1 files changed, 14 insertions, 2 deletions

diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 481bbb8c7220..3f6ef0630a8e 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -639,13 +639,19 @@ static int hidp_send_frame(struct socket *sock, unsigned char *data, int len)
 static void hidp_process_intr_transmit(struct hidp_session *session)
 {
         struct sk_buff *skb;
+        int ret;
 
         BT_DBG("session %p", session);
 
         while ((skb = skb_dequeue(&session->intr_transmit))) {
-                if (hidp_send_frame(session->intr_sock, skb->data, skb->len) < 0) {
+                ret = hidp_send_frame(session->intr_sock, skb->data, skb->len);
+                if (ret == -EAGAIN) {
                         skb_queue_head(&session->intr_transmit, skb);
                         break;
+                } else if (ret < 0) {
+                        hidp_session_terminate(session);
+                        kfree_skb(skb);
+                        break;
                 }
 
                 hidp_set_timer(session);
@@ -656,13 +662,19 @@ static void hidp_process_intr_transmit(struct hidp_session *session)
 static void hidp_process_ctrl_transmit(struct hidp_session *session)
 {
         struct sk_buff *skb;
+        int ret;
 
         BT_DBG("session %p", session);
 
         while ((skb = skb_dequeue(&session->ctrl_transmit))) {
-                if (hidp_send_frame(session->ctrl_sock, skb->data, skb->len) < 0) {
+                ret = hidp_send_frame(session->ctrl_sock, skb->data, skb->len);
+                if (ret == -EAGAIN) {
                         skb_queue_head(&session->ctrl_transmit, skb);
                         break;
+                } else if (ret < 0) {
+                        hidp_session_terminate(session);
+                        kfree_skb(skb);
+                        break;
                 }
 
                 hidp_set_timer(session);