Bluetooth: Properly check L2CAP config option output buffer length l4t/l4t-r24.2.2 tegra-l4t-r24.2.2
authorBen Seri <ben@armis.com>
Wed, 13 Sep 2017 08:34:32 +0000 (13:34 +0530)
committerWinnie Hsu <whsu@nvidia.com>
Wed, 20 Sep 2017 18:51:54 +0000 (11:51 -0700)
commit2cf304004f72896f86c89d2202dd262998152ccb
tree31247cb1681cf97cb680b765ad422e0c9cf087ba
parent5bbebe82e8462e1a276ab47d723f397cf93b8279
Bluetooth: Properly check L2CAP config option output buffer length

Validate the output buffer length for L2CAP config requests and responses
to avoid overflowing the stack buffer used for building the option blocks.

Bug 1989825

Change-Id: Id158ece2176c4ac339a7232dfde8c47ce2241122
Cc: stable@vger.kernel.org
Signed-off-by: Ben Seri <ben@armis.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1558940
(cherry picked from commit bb6128ed7d464d6dd7ffd3b0619827fca7419f02)
Reviewed-on: https://git-master.nvidia.com/r/1564089
net/bluetooth/l2cap_core.c