Bluetooth: Properly check L2CAP config option output buffer length
authorBen Seri <ben@armis.com>
Wed, 13 Sep 2017 08:34:32 +0000 (13:34 +0530)
committerMatthew Pedro <mapedro@nvidia.com>
Wed, 27 Sep 2017 04:28:18 +0000 (21:28 -0700)
commitc005032a3ffe77437f6ebc704af377fc9bc46279
treef9c4d5ed68a5746f9f783e742c6473483dfefa24
parent2db040946ff8340485b2b33fe5a46f3166fa96f6
Bluetooth: Properly check L2CAP config option output buffer length

Validate the output buffer length for L2CAP config requests and responses
to avoid overflowing the stack buffer used for building the option blocks.

Bug 1989825

Change-Id: Id158ece2176c4ac339a7232dfde8c47ce2241122
Cc: stable@vger.kernel.org
Signed-off-by: Ben Seri <ben@armis.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1558952
GVS: Gerrit_Virtual_Submit
net/bluetooth/l2cap_core.c