Bluetooth: Properly check L2CAP config option output buffer length

upstream e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 from
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git



Validate the output buffer length for L2CAP config requests and responses
to avoid overflowing the stack buffer used for building the option blocks.

Change-Id: I8f6498a250d8cfc13a11db01be67d4afc86edaf3
Cc: stable@vger.kernel.org
Signed-off-by: Ben Seri <ben@armis.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>