# \[PATCH net-next v4 4/7\] phonet: pep: do not write beyond optlen in getsockopt - From: Breno Leitao \ - Date: 2026-07-29 09:31:28 - List: netdev - Page: https://ratatoskr.run/netdev/2026/07/17334201 - Thread: https://ratatoskr.run/netdev/2026/07/17334197/t.md ```text pep_getsockopt() clamps the reported length to the caller's buffer with min_t(), but then stores the value with put_user(val, (int __user *) optval), which always writes sizeof(int) bytes. A getsockopt() call with an optlen smaller than sizeof(int) thus reports the clamped length yet writes a full int, one to three bytes past the user buffer. Write the value with copy_to_user() bounded by len, so at most optlen bytes are copied, matching the length reported back to userspace. Fixes: 02a47617cdce ("Phonet: implement GPRS virtual interface over PEP socket") Acked-by: Rémi Denis-Courmont Reviewed-by: Joe Damato Acked-by: Stanislav Fomichev Signed-off-by: Breno Leitao --- net/phonet/pep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/phonet/pep.c b/net/phonet/pep.c index 7069271393933..60d1a5375725b 100644 --- a/net/phonet/pep.c +++ b/net/phonet/pep.c @@ -1115,7 +1115,7 @@ static int pep_getsockopt(struct sock *sk, int level, int optname, len = min_t(unsigned int, sizeof(int), len); if (put_user(len, optlen)) return -EFAULT; - if (put_user(val, (int __user *) optval)) + if (copy_to_user(optval, &val, len)) return -EFAULT; return 0; } -- 2.53.0-Meta ```