diff options
| author | Zijun Hu <quic_zijuhu@quicinc.com> | 2021-11-16 16:51:38 +0800 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2021-11-16 13:57:25 +0100 |
| commit | dd2ac1d6d4954522c67279e42e7069b91f67f151 (patch) | |
| tree | 66efd01bd6d601835e68bd720e1a5a0fbd86101d /drivers/bluetooth/hci_h4.c | |
| parent | 258f56d11bbbf39df5bc5faf0119d28be528f27d (diff) | |
Bluetooth: hci_h4: Fix padding calculation error within h4_recv_buf()
it is erroneous to calculate padding by subtracting length of type
indication from skb->len, it will cause data analysis error for
alignment which is greater than 1, so fixed by adding length of type
indication with skb->len.
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'drivers/bluetooth/hci_h4.c')
| -rw-r--r-- | drivers/bluetooth/hci_h4.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c index 4b3b14a34794..1d0cdf023243 100644 --- a/drivers/bluetooth/hci_h4.c +++ b/drivers/bluetooth/hci_h4.c @@ -252,7 +252,7 @@ struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb, } if (!dlen) { - hu->padding = (skb->len - 1) % alignment; + hu->padding = (skb->len + 1) % alignment; hu->padding = (alignment - hu->padding) % alignment; /* No more data, complete frame */ @@ -260,7 +260,7 @@ struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb, skb = NULL; } } else { - hu->padding = (skb->len - 1) % alignment; + hu->padding = (skb->len + 1) % alignment; hu->padding = (alignment - hu->padding) % alignment; /* Complete frame */ |