summaryrefslogtreecommitdiffstats
path: root/drivers/bluetooth
diff options
context:
space:
mode:
authorLoic Poulain <loic.poulain@intel.com>2014-08-08 19:07:16 +0200
committerMarcel Holtmann <marcel@holtmann.org>2014-08-14 08:49:19 +0200
commit4807b51895dce8aa650ebebc51fa4a795ed6b8b8 (patch)
tree8030a32684c78cb7b03939e640ef58c522bd49a7 /drivers/bluetooth
parentBluetooth: Convert SMP to use l2cap_chan infrastructure (diff)
downloadlinux-4807b51895dce8aa650ebebc51fa4a795ed6b8b8.tar.xz
linux-4807b51895dce8aa650ebebc51fa4a795ed6b8b8.zip
Bluetooth: Fix HCI H5 corrupted ack value
In this expression: seq = (seq - 1) % 8 seq (u8) is implicitly converted to an int in the arithmetic operation. So if seq value is 0, operation is ((0 - 1) % 8) => (-1 % 8) => -1. The new seq value is 0xff which is an invalid ACK value, we expect 0x07. It leads to frequent dropped ACK and retransmission. Fix this by using '&' binary operator instead of '%'. Signed-off-by: Loic Poulain <loic.poulain@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Cc: stable@vger.kernel.org
Diffstat (limited to 'drivers/bluetooth')
-rw-r--r--drivers/bluetooth/hci_h5.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
index caacb422995d..a22838669b4e 100644
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -237,7 +237,7 @@ static void h5_pkt_cull(struct h5 *h5)
break;
to_remove--;
- seq = (seq - 1) % 8;
+ seq = (seq - 1) & 0x07;
}
if (seq != h5->rx_ack)