On Thu, Aug 06, 2026 at 02:41:59AM -0700, Breno Leitao wrote:
> getsockopt() on the multicast source filter options writes past the
> buffer the caller declared. Only the fixed header is checked against
> optlen. The number of sources copied out comes from gf_numsrc/
> imsf_numsrc, read back from optval, and nothing bounds that count by
> the space left in the buffer.
>
> I hit this while converting the mcast getsockopt paths to sockopt_t.
> Fixing it against 'net' first, so the fix is settled on its own before
> the conversion goes on top.
>
> Signed-off-by: Breno Leitao <leitao@debian.org>
> ---
> Breno Leitao (2):
> ipv4: mcast: getsockopt: do not overwrite past optlen
> ipv6: mcast: do not write past optlen in the source filter getsockopt
>
> net/ipv4/ip_sockglue.c | 16 ++++++++++++++++
> net/ipv6/ipv6_sockglue.c | 11 +++++++++++
> 2 files changed, 27 insertions(+)
For the series:
Reviewed-by: Simon Horman <horms@kernel.org>