2022-06-14 14:55:16

by Soenke Huster

[permalink] [raw]
Subject: [PATCH] Bluetooth: virtio_bt: Use skb_put to set length

By using skb_put we ensure that skb->tail is set
correctly. Currently, skb->tail is always zero, which
leads to errors, such as the following page fault in
rfcomm_recv_frame:

BUG: unable to handle page fault for address: ffffed1021de29ff
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
RIP: 0010:rfcomm_run+0x831/0x4040 (net/bluetooth/rfcomm/core.c:1751)

Signed-off-by: Soenke Huster <[email protected]>
---
drivers/bluetooth/virtio_bt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 67c21263f9e0..fd281d439505 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -219,7 +219,7 @@ static void virtbt_rx_work(struct work_struct *work)
if (!skb)
return;

- skb->len = len;
+ skb_put(skb, len);
virtbt_rx_handle(vbt, skb);

if (virtbt_add_inbuf(vbt) < 0)
--
2.36.1


2022-06-14 16:12:22

by bluez.test.bot

[permalink] [raw]
Subject: RE: Bluetooth: virtio_bt: Use skb_put to set length

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=650254

---Test result---

Test Summary:
CheckPatch PASS 1.11 seconds
GitLint PASS 0.73 seconds
SubjectPrefix PASS 0.61 seconds
BuildKernel PASS 33.59 seconds
BuildKernel32 PASS 29.90 seconds
Incremental Build with patchesPASS 38.97 seconds
TestRunner: Setup PASS 537.03 seconds
TestRunner: l2cap-tester PASS 14.48 seconds
TestRunner: bnep-tester PASS 4.49 seconds
TestRunner: mgmt-tester PASS 85.82 seconds
TestRunner: rfcomm-tester PASS 7.70 seconds
TestRunner: sco-tester PASS 7.47 seconds
TestRunner: smp-tester PASS 7.50 seconds
TestRunner: userchan-tester PASS 4.69 seconds



---
Regards,
Linux Bluetooth

2022-07-22 12:00:42

by Soenke Huster

[permalink] [raw]
Subject: Re: [PATCH] Bluetooth: virtio_bt: Use skb_put to set length

On 14.06.22 16:52, Soenke Huster wrote:
> By using skb_put we ensure that skb->tail is set
> correctly. Currently, skb->tail is always zero, which
> leads to errors, such as the following page fault in
> rfcomm_recv_frame:
>
> BUG: unable to handle page fault for address: ffffed1021de29ff
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> RIP: 0010:rfcomm_run+0x831/0x4040 (net/bluetooth/rfcomm/core.c:1751)
>
> Signed-off-by: Soenke Huster <[email protected]>
> ---
> drivers/bluetooth/virtio_bt.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
> index 67c21263f9e0..fd281d439505 100644
> --- a/drivers/bluetooth/virtio_bt.c
> +++ b/drivers/bluetooth/virtio_bt.c
> @@ -219,7 +219,7 @@ static void virtbt_rx_work(struct work_struct *work)
> if (!skb)
> return;
>
> - skb->len = len;
> + skb_put(skb, len);
> virtbt_rx_handle(vbt, skb);
>
> if (virtbt_add_inbuf(vbt) < 0)

Are there any issues with it, or is there another reason why it is not merged yet?

2022-07-22 18:17:32

by Luiz Augusto von Dentz

[permalink] [raw]
Subject: Re: [PATCH] Bluetooth: virtio_bt: Use skb_put to set length

Hi Sönke,

On Fri, Jul 22, 2022 at 4:59 AM Sönke Huster <[email protected]> wrote:
>
> On 14.06.22 16:52, Soenke Huster wrote:
> > By using skb_put we ensure that skb->tail is set
> > correctly. Currently, skb->tail is always zero, which
> > leads to errors, such as the following page fault in
> > rfcomm_recv_frame:
> >
> > BUG: unable to handle page fault for address: ffffed1021de29ff
> > #PF: supervisor read access in kernel mode
> > #PF: error_code(0x0000) - not-present page
> > RIP: 0010:rfcomm_run+0x831/0x4040 (net/bluetooth/rfcomm/core.c:1751)
> >
> > Signed-off-by: Soenke Huster <[email protected]>
> > ---
> > drivers/bluetooth/virtio_bt.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
> > index 67c21263f9e0..fd281d439505 100644
> > --- a/drivers/bluetooth/virtio_bt.c
> > +++ b/drivers/bluetooth/virtio_bt.c
> > @@ -219,7 +219,7 @@ static void virtbt_rx_work(struct work_struct *work)
> > if (!skb)
> > return;
> >
> > - skb->len = len;
> > + skb_put(skb, len);
> > virtbt_rx_handle(vbt, skb);
> >
> > if (virtbt_add_inbuf(vbt) < 0)
>
> Are there any issues with it, or is there another reason why it is not merged yet?

It appears it was removed from PW due to 30 days inactivity, when that
happens you should resend the patch since it needs to be retested by
CI.

--
Luiz Augusto von Dentz