Bluetooth: SCO: Fix sco_send_frame returning skb->len

The skb in modified by hci_send_sco which pushes SCO headers thus
changing skb->len causing sco_sock_sendmsg to fail.

Fixes: 0771cbb3b97d ("Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg")
Tested-by: Tedd Ho-Jeong An <tedd.an@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index f51399d1b9cbd8efb98f04bc9b70ee811f421f22..8eabf41b299394a85d8e020bb6b07415de9cf819 100644 (file)
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -284,16 +284,17 @@ static int sco_connect(struct hci_dev *hdev, struct sock *sk)
 static int sco_send_frame(struct sock *sk, struct sk_buff *skb)
 {
        struct sco_conn *conn = sco_pi(sk)->conn;
+       int len = skb->len;
 
        /* Check outgoing MTU */
-       if (skb->len > conn->mtu)
+       if (len > conn->mtu)
                return -EINVAL;
 
-       BT_DBG("sk %p len %d", sk, skb->len);
+       BT_DBG("sk %p len %d", sk, len);
 
        hci_send_sco(conn->hcon, skb);
 
-       return skb->len;
+       return len;
 }
 
 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
@@ -744,7 +745,8 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
                err = -ENOTCONN;
 
        release_sock(sk);
-       if (err)
+
+       if (err < 0)
                kfree_skb(skb);
        return err;
 }