2 files changed, 5 insertions, 5 deletions

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 600372d44578..28e5eeefdec8 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -66,7 +66,7 @@ struct bdaddr_list {
         struct list_head list;
         bdaddr_t bdaddr;
 };
-
+#define NUM_REASSEMBLY 4
 struct hci_dev {
         struct list_head list;
         spinlock_t      lock;
@@ -123,7 +123,7 @@ struct hci_dev {
         struct sk_buff_head     cmd_q;
 
         struct sk_buff          *sent_cmd;
-        struct sk_buff          *reassembly[3];
+        struct sk_buff          *reassembly[NUM_REASSEMBLY];
 
         struct mutex            req_lock;
         wait_queue_head_t       req_wait_q;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index aeb2982310a0..0ded790bfb67 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -914,7 +914,7 @@ int hci_register_dev(struct hci_dev *hdev)
         skb_queue_head_init(&hdev->cmd_q);
         skb_queue_head_init(&hdev->raw_q);
 
-        for (i = 0; i < 3; i++)
+        for (i = 0; i < NUM_REASSEMBLY; i++)
                 hdev->reassembly[i] = NULL;
 
         init_waitqueue_head(&hdev->req_wait_q);
@@ -973,7 +973,7 @@ int hci_unregister_dev(struct hci_dev *hdev)
 
         hci_dev_do_close(hdev);
 
-        for (i = 0; i < 3; i++)
+        for (i = 0; i < NUM_REASSEMBLY; i++)
                 kfree_skb(hdev->reassembly[i]);
 
         hci_notify(hdev, HCI_DEV_UNREG);
@@ -1034,7 +1034,7 @@ int hci_recv_frame(struct sk_buff *skb)
 EXPORT_SYMBOL(hci_recv_frame);
 
 /* Receive packet type fragment */
-#define __reassembly(hdev, type)  ((hdev)->reassembly[(type) - 2])
+#define __reassembly(hdev, type)  ((hdev)->reassembly[(type) - 1])
 
 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
 {