From 37b0e0ab2e2947d2cc6722d540a9f5a1fceabdcd Mon Sep 17 00:00:00 2001 From: Luiz Augusto von Dentz Date: Fri, 18 Nov 2016 15:53:43 +0200 Subject: [PATCH] Bluetooth: L2CAP: Fix segmentation The segments need to be limited by the minimun of the segment buffer tailroom and tx MPS not the original buf length. Change-Id: I580a3bb61aa190ac0cdd3717bc06fd6e6e668304 Signed-off-by: Luiz Augusto von Dentz --- subsys/bluetooth/host/l2cap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/subsys/bluetooth/host/l2cap.c b/subsys/bluetooth/host/l2cap.c index 41840c90ed4..7260af6c459 100644 --- a/subsys/bluetooth/host/l2cap.c +++ b/subsys/bluetooth/host/l2cap.c @@ -1593,7 +1593,7 @@ segment: } /* Don't send more that TX MPS including SDU length */ - len = min(buf->len, ch->tx.mps - sdu_hdr_len); + len = min(net_buf_tailroom(seg), ch->tx.mps - sdu_hdr_len); memcpy(net_buf_add(seg, len), buf->data, len); net_buf_pull(buf, len);