From 2cfef8cd7790bf1a8ee46db24cebe5a11f1dffd9 Mon Sep 17 00:00:00 2001 From: Luiz Augusto von Dentz Date: Thu, 19 Dec 2019 13:39:21 -0800 Subject: [PATCH] Bluetooth: L2CAP: Fix using s16_t to represent credits Credits are 2 octects long so an s16_t positive portion can only half to the theorical maximum number of credits, so instead this uses u16_t and do a bound check instead of checking for negative values. Signed-off-by: Luiz Augusto von Dentz --- subsys/bluetooth/host/l2cap.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/subsys/bluetooth/host/l2cap.c b/subsys/bluetooth/host/l2cap.c index 438dae0529e..43148b43fca 100644 --- a/subsys/bluetooth/host/l2cap.c +++ b/subsys/bluetooth/host/l2cap.c @@ -1599,16 +1599,19 @@ static void l2cap_chan_send_credits(struct bt_l2cap_le_chan *chan, static void l2cap_chan_update_credits(struct bt_l2cap_le_chan *chan, struct net_buf *buf) { - s16_t credits; + u16_t credits; + atomic_val_t old_credits = atomic_get(&chan->rx.credits); /* Restore enough credits to complete the sdu */ credits = ((chan->_sdu_len - net_buf_frags_len(buf)) + (chan->rx.mps - 1)) / chan->rx.mps; - credits -= atomic_get(&chan->rx.credits); - if (credits <= 0) { + + if (credits < old_credits) { return; } + credits -= old_credits; + l2cap_chan_send_credits(chan, buf, credits); }