diff options
| author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2021-09-16 13:10:49 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-07-29 17:06:52 +0200 |
| commit | edc1611fa8fadb5e0c6401a2bef2cc932c979b82 (patch) | |
| tree | 2e3be098b0b9a675e8b0e8b1b392672dc194ee6b /net/bluetooth | |
| parent | 7b92487051790a40e7ecdebe15a4cd4a68890035 (diff) | |
| download | linux-rt-edc1611fa8fadb5e0c6401a2bef2cc932c979b82.tar.gz | |
Bluetooth: SCO: Fix sco_send_frame returning skb->len
commit 037ce005af6b8a3e40ee07c6e9266c8997e6a4d6 upstream.
The skb in modified by hci_send_sco which pushes SCO headers thus
changing skb->len causing sco_sock_sendmsg to fail.
Fixes: 0771cbb3b97d ("Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg")
Tested-by: Tedd Ho-Jeong An <tedd.an@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/bluetooth')
| -rw-r--r-- | net/bluetooth/sco.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index 6d0d8632b47b..b3dd396ca649 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -282,16 +282,17 @@ static int sco_connect(struct hci_dev *hdev, struct sock *sk) static int sco_send_frame(struct sock *sk, struct sk_buff *skb) { struct sco_conn *conn = sco_pi(sk)->conn; + int len = skb->len; /* Check outgoing MTU */ - if (skb->len > conn->mtu) + if (len > conn->mtu) return -EINVAL; - BT_DBG("sk %p len %d", sk, skb->len); + BT_DBG("sk %p len %d", sk, len); hci_send_sco(conn->hcon, skb); - return skb->len; + return len; } static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb) @@ -732,7 +733,8 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, err = -ENOTCONN; release_sock(sk); - if (err) + + if (err < 0) kfree_skb(skb); return err; } |