mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-27 21:03:32 +00:00
Code Issues Releases Wiki Activity

Bluetooth: SCO: Fix sco_send_frame returning skb->len

Browse source 
commit 037ce005af upstream.

The skb in modified by hci_send_sco which pushes SCO headers thus
changing skb->len causing sco_sock_sendmsg to fail.

Fixes: 0771cbb3b9 ("Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg")
Tested-by: Tedd Ho-Jeong An <tedd.an@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Luiz Augusto von Dentz 2021-09-16 13:10:49 -07:00 committed by Greg Kroah-Hartman
parent e0d3a3e998
commit 2eb5a851e7
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
net/bluetooth/sco.c
View file

@ -282,16 +282,17 @@ static int sco_connect(struct hci_dev *hdev, struct sock *sk)
static int sco_send_frame(struct sock *sk, struct sk_buff *skb)
{
struct sco_conn *conn = sco_pi(sk)->conn;
int len = skb->len;
/* Check outgoing MTU */
if (skb->len > conn->mtu)
if (len > conn->mtu)
return -EINVAL;
BT_DBG("sk %p len %d", sk, skb->len);
BT_DBG("sk %p len %d", sk, len);
hci_send_sco(conn->hcon, skb);
return skb->len;
return len;
}
static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
@ -731,7 +732,8 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
err = -ENOTCONN;
release_sock(sk);
if (err)
if (err < 0)
kfree_skb(skb);
return err;
}