Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg

BugLink: https://bugs.launchpad.net/bugs/1988479
commit 0771cbb3b97d3c1d68eecd7f00055f599954c34e upstream.

This makes use of bt_skb_sendmsg instead of allocating a different
buffer to be used with memcpy_from_msg which cause one extra copy.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index c7b43c75677fccdd1eb28770a67807b71532118d..3ed90c5fbebb145720ca1fac96ee2f65f7d1965d 100644 (file)
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -280,27 +280,19 @@ static int sco_connect(struct hci_dev *hdev, struct sock *sk)
        return err;
 }
 
-static int sco_send_frame(struct sock *sk, void *buf, int len,
-                         unsigned int msg_flags)
+static int sco_send_frame(struct sock *sk, struct sk_buff *skb)
 {
        struct sco_conn *conn = sco_pi(sk)->conn;
-       struct sk_buff *skb;
-       int err;
 
        /* Check outgoing MTU */
-       if (len > conn->mtu)
+       if (skb->len > conn->mtu)
                return -EINVAL;
 
-       BT_DBG("sk %p len %d", sk, len);
+       BT_DBG("sk %p len %d", sk, skb->len);
 
-       skb = bt_skb_send_alloc(sk, len, msg_flags & MSG_DONTWAIT, &err);
-       if (!skb)
-               return err;
-
-       memcpy(skb_put(skb, len), buf, len);
        hci_send_sco(conn->hcon, skb);
 
-       return len;
+       return skb->len;
 }
 
 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
@@ -727,7 +719,7 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
                            size_t len)
 {
        struct sock *sk = sock->sk;
-       void *buf;
+       struct sk_buff *skb;
        int err;
 
        BT_DBG("sock %p, sk %p", sock, sk);
@@ -739,24 +731,20 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
        if (msg->msg_flags & MSG_OOB)
                return -EOPNOTSUPP;
 
-       buf = kmalloc(len, GFP_KERNEL);
-       if (!buf)
-               return -ENOMEM;
-
-       if (memcpy_from_msg(buf, msg, len)) {
-               kfree(buf);
-               return -EFAULT;
-       }
+       skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0);
+       if (IS_ERR_OR_NULL(skb))
+               return PTR_ERR(skb);
 
        lock_sock(sk);
 
        if (sk->sk_state == BT_CONNECTED)
-               err = sco_send_frame(sk, buf, len, msg->msg_flags);
+               err = sco_send_frame(sk, skb);
        else
                err = -ENOTCONN;
 
        release_sock(sk);
-       kfree(buf);
+       if (err)
+               kfree_skb(skb);
        return err;
 }