3 files changed, 7 insertions, 5 deletions

diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 97156c4abc8d..ab2db55982ca 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -382,7 +382,7 @@ static inline int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
                 break;
         }
 
-        memcpy(__skb_put(nskb, skb->len), skb->data, skb->len);
+        skb_copy_from_linear_data(skb, __skb_put(nskb, skb->len), skb->len);
         kfree_skb(skb);
 
         s->stats.rx_packets++;
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 3933608a9296..66bef1ccee2a 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -124,7 +124,7 @@ static inline void cmtp_add_msgpart(struct cmtp_session *session, int id, const
         }
 
         if (skb && (skb->len > 0))
-                memcpy(skb_put(nskb, skb->len), skb->data, skb->len);
+                skb_copy_from_linear_data(skb, skb_put(nskb, skb->len), skb->len);
 
         memcpy(skb_put(nskb, count), buf, count);
 
@@ -256,7 +256,7 @@ static void cmtp_process_transmit(struct cmtp_session *session)
                         hdr[2] = size >> 8;
                 }
 
-                memcpy(skb_put(nskb, size), skb->data, size);
+                skb_copy_from_linear_data(skb, skb_put(nskb, size), size);
                 skb_pull(skb, size);
 
                 if (skb->len > 0) {
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 162eab6a4478..a5867879b615 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2107,7 +2107,8 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
                 if (!(conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC)))
                         goto drop;
 
-                memcpy(skb_put(conn->rx_skb, skb->len), skb->data, skb->len);
+                skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+                              skb->len);
                 conn->rx_len = len - skb->len;
         } else {
                 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
@@ -2128,7 +2129,8 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
                         goto drop;
                 }
 
-                memcpy(skb_put(conn->rx_skb, skb->len), skb->data, skb->len);
+                skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+                              skb->len);
                 conn->rx_len -= skb->len;
 
                 if (!conn->rx_len) {