On 09/10, Breno Leitao wrote:
IP_MSFILTER reads its reply through ip_mc_msfget(), reached from
do_ip_getsockopt() and from nowhere else. Convert it, and build the
sockopt_t at the call site for as long as the caller still carries a
sockptr_t pair.
This is a special case, where optlen might only point
to the header, and the real structure size is inside the header.
This is nasty, but, in order to avoid breaking userspace, we need to
preserve the same mechanism, by:
1) Only applying it for userspace address, otherwise it is too risky
2) Assume there is room to support the new size (in userspace)
The source list also moves from copy_to_sockptr_offset() to a sequential
copy_to_iter(). IP_MSFILTER_SIZE(0) and offsetof(struct ip_msfilter,
imsf_slist_flex) are both 16, so the bytes land where they did.
Signed-off-by: Breno Leitao <leitao@debian.org>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>