[PATCH Resend] Bluetooth: virtio_bt: Use skb_put to set length

[PATCH Resend] Bluetooth: virtio_bt: Use skb_put to set length

[Soenke Huster]

By using skb_put we ensure that skb->tail is set
correctly. Currently, skb->tail is always zero, which
leads to errors, such as the following page fault in
rfcomm_recv_frame:

    BUG: unable to handle page fault for address: ffffed1021de29ff
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) - not-present page
    RIP: 0010:rfcomm_run+0x831/0x4040 (net/bluetooth/rfcomm/core.c:1751)

Signed-off-by: Soenke Huster <soenke.huster@eknoes.de>
---
 drivers/bluetooth/virtio_bt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 67c21263f9e0..fd281d439505 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -219,7 +219,7 @@ static void virtbt_rx_work(struct work_struct *work)
 	if (!skb)
 		return;
 
-	skb->len = len;
+	skb_put(skb, len);
 	virtbt_rx_handle(vbt, skb);
 
 	if (virtbt_add_inbuf(vbt) < 0)
-- 
2.36.1

RE: [Resend] Bluetooth: virtio_bt: Use skb_put to set length

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1097 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=662674

---Test result---

Test Summary:
CheckPatch                    PASS      1.93 seconds
GitLint                       PASS      1.15 seconds
SubjectPrefix                 PASS      0.94 seconds
BuildKernel                   PASS      35.95 seconds
BuildKernel32                 PASS      31.76 seconds
Incremental Build with patchesPASS      54.12 seconds
TestRunner: Setup             PASS      534.87 seconds
TestRunner: l2cap-tester      PASS      17.22 seconds
TestRunner: bnep-tester       PASS      6.22 seconds
TestRunner: mgmt-tester       PASS      103.51 seconds
TestRunner: rfcomm-tester     PASS      9.55 seconds
TestRunner: sco-tester        PASS      9.40 seconds
TestRunner: smp-tester        PASS      9.23 seconds
TestRunner: userchan-tester   PASS      6.22 seconds



---
Regards,
Linux Bluetooth

Re: [PATCH Resend] Bluetooth: virtio_bt: Use skb_put to set length

[Luiz Augusto von Dentz]

Hi Soenke,

On Sun, Jul 24, 2022 at 11:53 PM Soenke Huster <soenke.huster@eknoes.de> wrote:
>
> By using skb_put we ensure that skb->tail is set
> correctly. Currently, skb->tail is always zero, which
> leads to errors, such as the following page fault in
> rfcomm_recv_frame:
>
>     BUG: unable to handle page fault for address: ffffed1021de29ff
>     #PF: supervisor read access in kernel mode
>     #PF: error_code(0x0000) - not-present page
>     RIP: 0010:rfcomm_run+0x831/0x4040 (net/bluetooth/rfcomm/core.c:1751)

Please add the Fixes tag with the original patch that introduced the problem.

> Signed-off-by: Soenke Huster <soenke.huster@eknoes.de>
> ---
>  drivers/bluetooth/virtio_bt.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
> index 67c21263f9e0..fd281d439505 100644
> --- a/drivers/bluetooth/virtio_bt.c
> +++ b/drivers/bluetooth/virtio_bt.c
> @@ -219,7 +219,7 @@ static void virtbt_rx_work(struct work_struct *work)
>         if (!skb)
>                 return;
>
> -       skb->len = len;
> +       skb_put(skb, len);
>         virtbt_rx_handle(vbt, skb);
>
>         if (virtbt_add_inbuf(vbt) < 0)
> --
> 2.36.1
>


-- 
Luiz Augusto von Dentz