Ben Seri d69a7047bb Bluetooth: Properly check L2CAP config option output buffer length ...

Validate the output buffer length for L2CAP config requests and responses
to avoid overflowing the stack buffer used for building the option blocks.

Change-Id: I7a0ff0b9dd0156c0e6383214a9c86e4ec4c0d236
Cc: stable@vger.kernel.org
Signed-off-by: Ben Seri <ben@armis.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
CVE-2017-1000251
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>

2019-08-08 12:09:02 +02:00

..

amp.h

Update copyright to The Linux Foundation

2013-02-13 16:38:12 -08:00

bluetooth.h

Bluetooth: Introduce new security level

2013-02-21 11:37:48 +05:30

hci_core.h

Merge tag 'v3.4.113' into lineage-16.0

2019-08-05 14:20:47 +02:00

hci.h

Bluetooth : Recover BT, if hardware error event is received from the SOC

2013-04-28 00:14:26 +05:30

l2cap.h

Bluetooth: Properly check L2CAP config option output buffer length

2019-08-08 12:09:02 +02:00

mgmt.h

Merge tag 'v3.4.113' into lineage-16.0

2019-08-05 14:20:47 +02:00

rfcomm.h

Bluetooth: rfcomm: Fix sleep in invalid context in rfcomm_security_cfm

2011-11-07 17:24:49 -02:00

sco.h

Update copyright to The Linux Foundation

2013-02-13 16:38:12 -08:00

smp.h

Merge tag 'v3.4.113' into lineage-16.0

2019-08-05 14:20:47 +02:00