From 9cc144d95eb746a6853cc5a463fc53d1e604d4a4 Mon Sep 17 00:00:00 2001 From: Adriano Cordova Date: Tue, 8 Sep 2026 13:54:13 -0300 Subject: [PATCH] Bluetooth: bnep: linearize skb before sending kernel_sendmsg expects contiguous data. Linearize the skb in the bnep_session() loop, before bnep_tx_frame builds its kvec, so it is not split across non-linear pages. Drop the dead block and FIXME. Signed-off-by: Adriano Cordova Signed-off-by: Luiz Augusto von Dentz --- net/bluetooth/bnep/core.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c index f57b4323ab2f..06854f46ba34 100644 --- a/net/bluetooth/bnep/core.c +++ b/net/bluetooth/bnep/core.c @@ -495,10 +495,7 @@ static int bnep_tx_frame(struct bnep_session *s, struct sk_buff *skb) iv[il++] = (struct kvec) { skb->data, skb->len }; len += skb->len; - /* FIXME: linearize skb */ - { - len = kernel_sendmsg(sock, &s->msg, iv, il, len); - } + len = kernel_sendmsg(sock, &s->msg, iv, il, len); kfree_skb(skb); if (len > 0) { @@ -539,9 +536,12 @@ static int bnep_session(void *arg) break; /* TX */ - while ((skb = skb_dequeue(&sk->sk_write_queue))) - if (bnep_tx_frame(s, skb)) + while ((skb = skb_dequeue(&sk->sk_write_queue))) { + if (skb_linearize(skb)) + kfree_skb(skb); + else if (bnep_tx_frame(s, skb)) break; + } netif_wake_queue(dev); /*