From 786208aedd8f75b0720e36b2ca66b3a411417301 Mon Sep 17 00:00:00 2001
From: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
Date: Thu, 22 Oct 2015 21:26:58 +0200
Subject: merged 3.0.101 tag

---
 net/bluetooth/l2cap_core.c | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'net/bluetooth/l2cap_core.c')

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b044c38..8d0e801 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1823,6 +1823,9 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
 	BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
 			conn, code, ident, dlen);
 
+	if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
+		return NULL;
+
 	len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
 	count = min_t(unsigned int, conn->mtu, len);
 
-- 
cgit v1.1