UPSTREAM: Bluetooth: Properly check L2CAP config option output buffer length
Validate the output buffer length for L2CAP config requests and responses
to avoid overflowing the stack buffer used for building the option blocks.
BUG=chromium:764425
TEST=Build and run
Change-Id: I62362e78a73e7f14c10b6cbbefc6b44ce6bdbcc8
Cc: stable@vger.kernel.org
Signed-off-by: Ben Seri <ben@armis.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
(cherry picked from commit e860d2c904d1)
Reviewed-on: https://chromium-review.googlesource.com/663611
Reviewed-by: Mattias Nissler <mnissler@chromium.org>
1 file changed
