diff options
| -rw-r--r-- | net/bluetooth/l2cap.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c index 4609d9c94f41..615fecc5b3d4 100644 --- a/net/bluetooth/l2cap.c +++ b/net/bluetooth/l2cap.c | |||
| @@ -2830,6 +2830,11 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr | |||
| 2830 | int len = cmd->len - sizeof(*rsp); | 2830 | int len = cmd->len - sizeof(*rsp); |
| 2831 | char req[64]; | 2831 | char req[64]; |
| 2832 | 2832 | ||
| 2833 | if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) { | ||
| 2834 | l2cap_send_disconn_req(conn, sk); | ||
| 2835 | goto done; | ||
| 2836 | } | ||
| 2837 | |||
| 2833 | /* throw out any old stored conf requests */ | 2838 | /* throw out any old stored conf requests */ |
| 2834 | result = L2CAP_CONF_SUCCESS; | 2839 | result = L2CAP_CONF_SUCCESS; |
| 2835 | len = l2cap_parse_conf_rsp(sk, rsp->data, | 2840 | len = l2cap_parse_conf_rsp(sk, rsp->data, |