Bluetooth: Fix breakage in amp_write_rem_assoc_frag()
authorDan Carpenter <dan.carpenter@oracle.com>
Sat, 1 Aug 2015 12:30:08 +0000 (15:30 +0300)
committerMarcel Holtmann <marcel@holtmann.org>
Mon, 10 Aug 2015 18:41:34 +0000 (20:41 +0200)
We should be passing the pointer itself instead of the address of the
pointer.

This was a copy and paste bug when we replaced the calls to
hci_send_cmd().  Originally, the arguments were "len, cp" but we
overwrote them with "sizeof(cp), &cp" by mistake.

Fixes: b3d3914006a0 ('Bluetooth: Move amp assoc read/write completed callback to amp.c')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
net/bluetooth/amp.c

index 238ddd3cf95fb660d41f751821a09550f977f067..e32f34189007967e7674a501e2c944029623cfab 100644 (file)
@@ -379,7 +379,7 @@ static bool amp_write_rem_assoc_frag(struct hci_dev *hdev,
        amp_ctrl_put(ctrl);
 
        hci_req_init(&req, hdev);
-       hci_req_add(&req, HCI_OP_WRITE_REMOTE_AMP_ASSOC, sizeof(cp), &cp);
+       hci_req_add(&req, HCI_OP_WRITE_REMOTE_AMP_ASSOC, len, cp);
        hci_req_run_skb(&req, write_remote_amp_assoc_complete);
 
        kfree(cp);