diff options
| author | Steven Rostedt (Red Hat) <rostedt@goodmis.org> | 2013-07-10 08:49:38 -0400 |
|---|---|---|
| committer | Steven Rostedt <rostedt@goodmis.org> | 2013-07-10 08:49:38 -0400 |
| commit | 5914bf382927cbfec2944be80f518d36912eca38 (patch) | |
| tree | 62bc7a98dd8ed0d45670307bf08dc1e89fd0ed23 /net | |
| parent | 633dbe55379f885960987eda9097a1296144ddd8 (diff) | |
| parent | 2d0ed86595ca3a101c710efaec7aab0ca69c76da (diff) | |
Merge tag 'v3.0.85' into v3.0-rt
This is the 3.0.85 stable release
Diffstat (limited to 'net')
| -rw-r--r-- | net/bluetooth/l2cap_core.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 7705e26e699f..2a7487727926 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -1514,6 +1514,9 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d", conn, code, ident, dlen); + if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE) + return NULL; + len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen; count = min_t(unsigned int, conn->mtu, len); |