diff mbox series

[v4,4/4] Bluetooth: SCO: Fix sco_send_frame returning skb->len

Message ID 20210915233600.4129808-4-luiz.dentz@gmail.com
State Superseded
Headers show
Series [v4,1/4] Bluetooth: hci_sock: Add support for BT_{SND,RCV}BUF | expand

Commit Message

Luiz Augusto von Dentz Sept. 15, 2021, 11:36 p.m. UTC 
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The skb in modified by hci_send_sco which pushes SCO headers thus
changing skb->len causing sco_sock_sendmsg to fail.

Fixes: 0771cbb3b97d ("Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 net/bluetooth/sco.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

Comments

Tedd Ho-Jeong An Sept. 16, 2021, 12:08 a.m. UTC | #1 
Hi Luiz,

On Wed, 2021-09-15 at 16:36 -0700, Luiz Augusto von Dentz wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

> 

> The skb in modified by hci_send_sco which pushes SCO headers thus

> changing skb->len causing sco_sock_sendmsg to fail.

> 

> Fixes: 0771cbb3b97d ("Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg")

> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>


Tested-by: Tedd Ho-Jeong An <tedd.an@intel.com>
diff mbox series

Patch

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index f51399d1b9cb..8eabf41b2993 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -284,16 +284,17 @@  static int sco_connect(struct hci_dev *hdev, struct sock *sk)
 static int sco_send_frame(struct sock *sk, struct sk_buff *skb)
 {
 	struct sco_conn *conn = sco_pi(sk)->conn;
+	int len = skb->len;
 
 	/* Check outgoing MTU */
-	if (skb->len > conn->mtu)
+	if (len > conn->mtu)
 		return -EINVAL;
 
-	BT_DBG("sk %p len %d", sk, skb->len);
+	BT_DBG("sk %p len %d", sk, len);
 
 	hci_send_sco(conn->hcon, skb);
 
-	return skb->len;
+	return len;
 }
 
 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
@@ -744,7 +745,8 @@  static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 		err = -ENOTCONN;
 
 	release_sock(sk);
-	if (err)
+
+	if (err < 0)
 		kfree_skb(skb);
 	return err;
 }