UPSTREAM: Bluetooth: Properly check L2CAP config option output buffer length

Validate the output buffer length for L2CAP config requests and responses
to avoid overflowing the stack buffer used for building the option blocks.

TEST=Build and run

Change-Id: I62362e78a73e7f14c10b6cbbefc6b44ce6bdbcc8
Signed-off-by: Ben Seri <>
Signed-off-by: Marcel Holtmann <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Guenter Roeck <>
(cherry picked from commit e860d2c904d1)
Reviewed-by: Mattias Nissler <>
1 file changed