From: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
commit 037ce005af6b8a3e40ee07c6e9266c8997e6a4d6 upstream.
The skb in modified by hci_send_sco which pushes SCO headers thus
changing skb->len causing sco_sock_sendmsg to fail.
Fixes: 0771cbb3b97d ("Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg")
Tested-by: Tedd Ho-Jeong An <tedd.an@xxxxxxxxx>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
Signed-off-by: Marcel Holtmann <marcel@xxxxxxxxxxxx>
Cc: Harshit Mogalapalli <harshit.m.mogalapalli@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/bluetooth/sco.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -282,16 +282,17 @@ static int sco_connect(struct hci_dev *h
static int sco_send_frame(struct sock *sk, struct sk_buff *skb)
{
struct sco_conn *conn = sco_pi(sk)->conn;
+ int len = skb->len;
/* Check outgoing MTU */
- if (skb->len > conn->mtu)
+ if (len > conn->mtu)
return -EINVAL;
- BT_DBG("sk %p len %d", sk, skb->len);
+ BT_DBG("sk %p len %d", sk, len);
hci_send_sco(conn->hcon, skb);
- return skb->len;
+ return len;
}
static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
@@ -732,7 +733,8 @@ static int sco_sock_sendmsg(struct socke
err = -ENOTCONN;
release_sock(sk);
- if (err)
+
+ if (err < 0)
kfree_skb(skb);
return err;
}
