[PATCH] Bluetooth: Fix wrong set of skb fragments

[PATCH] Bluetooth: Fix wrong set of skb fragments

[Gustavo Padovan]

If alloc() fails we let the frags linked list with garbage value(the err
ptr value) in its last element.

Reported-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
---
 net/bluetooth/l2cap_core.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 869beb3..8c8a803 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1836,13 +1836,17 @@ static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
 	/* Continuation fragments (no L2CAP header) */
 	frag = &skb_shinfo(skb)->frag_list;
 	while (len) {
+		struct sk_buff *tmp;
+
 		count = min_t(unsigned int, conn->mtu, len);
 
-		*frag = chan->ops->alloc_skb(chan, count,
+		tmp = chan->ops->alloc_skb(chan, count,
 					     msg->msg_flags & MSG_DONTWAIT);
+		if (IS_ERR(tmp))
+			return PTR_ERR(tmp);
+
+		*frag = tmp;
 
-		if (IS_ERR(*frag))
-			return PTR_ERR(*frag);
 		if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
 			return -EFAULT;
 
-- 
1.7.10.1

Re: [PATCH] Bluetooth: Fix wrong set of skb fragments

[Mat Martineau]

Gustavo -

On Tue, 15 May 2012, Gustavo Padovan wrote:

> If alloc() fails we let the frags linked list with garbage value(the err
> ptr value) in its last element.

Change "let" to "left", maybe?  Also missing a space after the first 
"value".

> Reported-by: Mat Martineau <mathewm@codeaurora.org>
> Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
> ---
> net/bluetooth/l2cap_core.c |   10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 869beb3..8c8a803 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -1836,13 +1836,17 @@ static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
> 	/* Continuation fragments (no L2CAP header) */
> 	frag = &skb_shinfo(skb)->frag_list;
> 	while (len) {
> +		struct sk_buff *tmp;
> +
> 		count = min_t(unsigned int, conn->mtu, len);
>
> -		*frag = chan->ops->alloc_skb(chan, count,
> +		tmp = chan->ops->alloc_skb(chan, count,
> 					     msg->msg_flags & MSG_DONTWAIT);

Fix up the alignment of the continuation line here.

> +		if (IS_ERR(tmp))
> +			return PTR_ERR(tmp);
> +
> +		*frag = tmp;
>
> -		if (IS_ERR(*frag))
> -			return PTR_ERR(*frag);
> 		if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
> 			return -EFAULT;
>
> -- 
> 1.7.10.1

Other than that, it looks good to me!

--
Mat Martineau
Employee of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum