Bluetooth: Properly check L2CAP config option output buffer length

Bluetooth: Properly check L2CAP config option output buffer length

Orabug: 26790014
CVE: CVE-2017-1000251

Validate the output buffer length for L2CAP config requests and responses
to avoid overflowing the stack buffer used for building the option blocks.

Cc: stable@vger.kernel.org
Signed-off-by: Ben Seri <ben@armis.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3)
Signed-off-by: Todd Vierling <todd.vierling@oracle.com>
Reviewed-by: Brian Maly <brian.maly@oracle.com>