From: Loic Poulain Date: Fri, 8 Aug 2014 17:07:16 +0000 (+0200) Subject: Bluetooth: Fix HCI H5 corrupted ack value X-Git-Tag: firefly_0821_release~3679^2~1340 X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=90f9a6a427abd19c8d304ecbac034deb39d0737c;p=firefly-linux-kernel-4.4.55.git Bluetooth: Fix HCI H5 corrupted ack value commit 4807b51895dce8aa650ebebc51fa4a795ed6b8b8 upstream. In this expression: seq = (seq - 1) % 8 seq (u8) is implicitly converted to an int in the arithmetic operation. So if seq value is 0, operation is ((0 - 1) % 8) => (-1 % 8) => -1. The new seq value is 0xff which is an invalid ACK value, we expect 0x07. It leads to frequent dropped ACK and retransmission. Fix this by using '&' binary operator instead of '%'. Signed-off-by: Loic Poulain Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c index db0be2fb05fe..db35c542eb20 100644 --- a/drivers/bluetooth/hci_h5.c +++ b/drivers/bluetooth/hci_h5.c @@ -237,7 +237,7 @@ static void h5_pkt_cull(struct h5 *h5) break; to_remove--; - seq = (seq - 1) % 8; + seq = (seq - 1) & 0x07; } if (seq != h5->rx_ack)