Bluetooth: Fix length for Read Local OOB Extended Data respone packet
authorMarcel Holtmann <marcel@holtmann.org>
Mon, 16 Mar 2015 23:05:44 +0000 (16:05 -0700)
committerJohan Hedberg <johan.hedberg@intel.com>
Tue, 17 Mar 2015 06:16:45 +0000 (08:16 +0200)
The length of the respone packet for Read Local OOB Extended Data
command has a calculation error. In case LE Secure Connections support
is not enabled, the actual response is shorter. Keep this in mind and
update the value accordingly.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
net/bluetooth/mgmt.c

index 32c2c75c0888c8e1bac45b401a5577d93cae580d..7fa3c4b8384ba1e316ba624405a4c40e8ef633e2 100644 (file)
@@ -6388,7 +6388,7 @@ static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
        hci_dev_unlock(hdev);
 
        err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
-                               MGMT_STATUS_SUCCESS, rp, rp_len);
+                               MGMT_STATUS_SUCCESS, rp, sizeof(*rp) + eir_len);
 
 done:
        kfree(rp);