2021-09-15 23:38:19

by Luiz Augusto von Dentz

Subject: [PATCH v4 4/4] Bluetooth: SCO: Fix sco_send_frame returning skb->len

From: Luiz Augusto von Dentz <[email protected]>

The skb in modified by hci_send_sco which pushes SCO headers thus
changing skb->len causing sco_sock_sendmsg to fail.

Fixes: 0771cbb3b97d ("Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg")
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
---
net/bluetooth/sco.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index f51399d1b9cb..8eabf41b2993 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -284,16 +284,17 @@ static int sco_connect(struct hci_dev *hdev, struct sock *sk)
static int sco_send_frame(struct sock *sk, struct sk_buff *skb)
{
struct sco_conn *conn = sco_pi(sk)->conn;
+ int len = skb->len;

/* Check outgoing MTU */
- if (skb->len > conn->mtu)
+ if (len > conn->mtu)
return -EINVAL;

- BT_DBG("sk %p len %d", sk, skb->len);
+ BT_DBG("sk %p len %d", sk, len);

hci_send_sco(conn->hcon, skb);

- return skb->len;
+ return len;
}

static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
@@ -744,7 +745,8 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
err = -ENOTCONN;

release_sock(sk);
- if (err)
+
+ if (err < 0)
kfree_skb(skb);
return err;
}
--
2.31.1

2021-09-16 00:09:16

by Tedd Ho-Jeong An

Subject: Re: [PATCH v4 4/4] Bluetooth: SCO: Fix sco_send_frame returning skb->len

Hi Luiz,

On Wed, 2021-09-15 at 16:36 -0700, Luiz Augusto von Dentz wrote:
> From: Luiz Augusto von Dentz <[email protected]>
>
> The skb in modified by hci_send_sco which pushes SCO headers thus
> changing skb->len causing sco_sock_sendmsg to fail.
>
> Fixes: 0771cbb3b97d ("Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg")
> Signed-off-by: Luiz Augusto von Dentz <[email protected]>

Tested-by: Tedd Ho-Jeong An <[email protected]>