Bluetooth: hci_conn: Fix not allowing valid CIS ID

Only the number of CIS shall be limited to 0x1f, the CIS ID in the
other hand is up to 0xef.

Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 6132eed7e8dcdf675050fe8636a1e081f41b1c32..71e5a4c2e5230baa9e75e8094656f4b8b48c7313 100644 (file)
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1846,9 +1846,12 @@ static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
                cis_add(&data, qos);
        }
 
-       /* Reprogram all CIS(s) with the same CIG */
-       for (data.cig = qos->ucast.cig, data.cis = 0x00; data.cis < 0x11;
-            data.cis++) {
+       /* Reprogram all CIS(s) with the same CIG, valid range are:
+        * num_cis: 0x00 to 0x1F
+        * cis_id: 0x00 to 0xEF
+        */
+       for (data.cig = qos->ucast.cig, data.cis = 0x00; data.cis < 0xf0 &&
+            data.pdu.cp.num_cis < ARRAY_SIZE(data.pdu.cis); data.cis++) {
                data.count = 0;
 
                hci_conn_hash_list_state(hdev, cis_list, ISO_LINK, BT_BOUND,