As skb->tail might be zero, it can underflow. This leads to a page fault: skb_tail_pointer simply adds skb->tail (which is now MAX_UINT) to skb->head. BUG: unable to handle page fault for address: ffffed1021de29ff #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page RIP: 0010:rfcomm_run+0x831/0x4040 (net/bluetooth/rfcomm/core.c:1751) By using skb_trim instead of the direct manipulation, skb->tail is reset. Thus, the correct pointer to the checksum is used. Signed-off-by: Soenke Huster <soenke.huster@xxxxxxxxx> --- v2: Clarified how the bug triggers, minimize code change net/bluetooth/rfcomm/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c index 7324764384b6..443b55edb3ab 100644 --- a/net/bluetooth/rfcomm/core.c +++ b/net/bluetooth/rfcomm/core.c @@ -1747,7 +1747,7 @@ static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s, type = __get_type(hdr->ctrl); /* Trim FCS */ - skb->len--; skb->tail--; + skb_trim(skb, skb->len - 1); fcs = *(u8 *)skb_tail_pointer(skb); if (__check_fcs(skb->data, type, fcs)) { -- 2.36.1