Re: [PATCH net 0/2] net: mcast: do not write past optlen in the source filter getsockopt

On Thu, Aug 06, 2026 at 02:41:59AM -0700, Breno Leitao wrote:

getsockopt() on the multicast source filter options writes past the
buffer the caller declared. Only the fixed header is checked against
optlen. The number of sources copied out comes from gf_numsrc/
imsf_numsrc, read back from optval, and nothing bounds that count by
the space left in the buffer.

I hit this while converting the mcast getsockopt paths to sockopt_t.
Fixing it against 'net' first, so the fix is settled on its own before
the conversion goes on top.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
Breno Leitao (2):
      ipv4: mcast: getsockopt: do not overwrite past optlen
      ipv6: mcast: do not write past optlen in the source filter getsockopt

 net/ipv4/ip_sockglue.c   | 16 ++++++++++++++++
 net/ipv6/ipv6_sockglue.c | 11 +++++++++++
 2 files changed, 27 insertions(+)

For the series:

Reviewed-by: Simon Horman <horms@kernel.org>