On Wed, Jun 8, 2022 at 6:51 AM Soenke Huster <soenke.huster@xxxxxxxxx> wrote: > > Use the skb helper instead of direct manipulation. This fixes the > following page fault, when connecting my Android phone: > > BUG: unable to handle page fault for address: ffffed1021de29ff > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > RIP: 0010:rfcomm_run+0x831/0x4040 (net/bluetooth/rfcomm/core.c:1751) > > Signed-off-by: Soenke Huster <soenke.huster@xxxxxxxxx> > --- > net/bluetooth/rfcomm/core.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c > index 7324764384b6..7360e905d045 100644 > --- a/net/bluetooth/rfcomm/core.c > +++ b/net/bluetooth/rfcomm/core.c > @@ -1747,8 +1747,8 @@ static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s, > type = __get_type(hdr->ctrl); > > /* Trim FCS */ > - skb->len--; skb->tail--; > - fcs = *(u8 *)skb_tail_pointer(skb); > + skb_trim(skb, skb->len - 1); > + fcs = *(skb->data + skb->len); > Hmmm... I do not see any difference before/after in term of memory dereference to get fcs. I think you should give more details on how exactly the bug triggers.
