Commit 0b59e272 authored by Tetsuo Handa's avatar Tetsuo Handa Committed by Marcel Holtmann
Browse files

Bluetooth: reorganize functions from hci_sock_sendmsg() 



Since userfaultfd mechanism allows sleeping with kernel lock held,
avoiding page fault with kernel lock held where possible will make
the module more robust. This patch just brings memcpy_from_msg() calls
to out of sock lock.

Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 1b9fbe81

net/bluetooth/hci_sock.c

+21 −29
Original line number Diff line number Diff line
@@ -1505,10 +1505,8 @@ static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg, 
	return err ? : copied;

}



static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk,

			struct msghdr *msg, size_t msglen)

static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk, void *buf, size_t msglen)

{

	void *buf;

	u8 *cp;

	struct mgmt_hdr *hdr;

	u16 opcode, index, len;
@@ -1522,15 +1520,6 @@ static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk, 
	if (msglen < sizeof(*hdr))

		return -EINVAL;



	buf = kmalloc(msglen, GFP_KERNEL);

	if (!buf)

		return -ENOMEM;



	if (memcpy_from_msg(buf, msg, msglen)) {

		err = -EFAULT;

		goto done;

	}



	hdr = buf;

	opcode = __le16_to_cpu(hdr->opcode);

	index = __le16_to_cpu(hdr->index);
@@ -1627,11 +1616,10 @@ static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk, 
	if (hdev)

		hci_dev_put(hdev);



	kfree(buf);

	return err;

}



static int hci_logging_frame(struct sock *sk, struct msghdr *msg, int len)

static int hci_logging_frame(struct sock *sk, void *buf, int len, unsigned int flags)

{

	struct hci_mon_hdr *hdr;

	struct sk_buff *skb;
@@ -1646,14 +1634,11 @@ static int hci_logging_frame(struct sock *sk, struct msghdr *msg, int len) 
	if (len < sizeof(*hdr) + 3)

		return -EINVAL;



	skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);

	skb = bt_skb_send_alloc(sk, len, flags & MSG_DONTWAIT, &err);

	if (!skb)

		return err;



	if (memcpy_from_msg(skb_put(skb, len), msg, len)) {

		err = -EFAULT;

		goto drop;

	}

	memcpy(skb_put(skb, len), buf, len);



	hdr = (void *)skb->data;
@@ -1723,19 +1708,28 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, 
	struct hci_dev *hdev;

	struct sk_buff *skb;

	int err;

	void *buf;

	const unsigned int flags = msg->msg_flags;



	BT_DBG("sock %p sk %p", sock, sk);



	if (msg->msg_flags & MSG_OOB)

	if (flags & MSG_OOB)

		return -EOPNOTSUPP;



	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE|

			       MSG_CMSG_COMPAT))

	if (flags & ~(MSG_DONTWAIT | MSG_NOSIGNAL | MSG_ERRQUEUE | MSG_CMSG_COMPAT))

		return -EINVAL;



	if (len < 4 || len > HCI_MAX_FRAME_SIZE)

		return -EINVAL;



	buf = kmalloc(len, GFP_KERNEL);

	if (!buf)

		return -ENOMEM;

	if (memcpy_from_msg(buf, msg, len)) {

		kfree(buf);

		return -EFAULT;

	}



	lock_sock(sk);



	switch (hci_pi(sk)->channel) {
@@ -1746,13 +1740,13 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, 
		err = -EOPNOTSUPP;

		goto done;

	case HCI_CHANNEL_LOGGING:

		err = hci_logging_frame(sk, msg, len);

		err = hci_logging_frame(sk, buf, len, flags);

		goto done;

	default:

		mutex_lock(&mgmt_chan_list_lock);

		chan = __hci_mgmt_chan_find(hci_pi(sk)->channel);

		if (chan)

			err = hci_mgmt_cmd(chan, sk, msg, len);

			err = hci_mgmt_cmd(chan, sk, buf, len);

		else

			err = -EINVAL;
@@ -1771,14 +1765,11 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, 
		goto done;

	}



	skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);

	skb = bt_skb_send_alloc(sk, len, flags & MSG_DONTWAIT, &err);

	if (!skb)

		goto done;



	if (memcpy_from_msg(skb_put(skb, len), msg, len)) {

		err = -EFAULT;

		goto drop;

	}

	memcpy(skb_put(skb, len), buf, len);



	hci_skb_pkt_type(skb) = skb->data[0];

	skb_pull(skb, 1);
@@ -1850,6 +1841,7 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, 


done:

	release_sock(sk);

	kfree(buf);

	return err;



drop: