Re: [PATCH net] ipv4: clamp MCAST_MSFILTER getsockopt to optlen, not gf_numsrc

[Paolo Abeni]

On 4/23/26 4:18 PM, Greg Kroah-Hartman wrote:
> On Thu, Apr 23, 2026 at 03:57:55PM +0200, Paolo Abeni wrote:
>> On 4/20/26 9:26 PM, Greg Kroah-Hartman wrote:
>>> @@ -1486,8 +1491,12 @@ static int compat_ip_get_mcast_msfilter(struct sock *sk, sockptr_t optval,
>>>  	gf.gf_interface = gf32.gf_interface;
>>>  	gf.gf_fmode = gf32.gf_fmode;
>>>  	num = gf.gf_numsrc = gf32.gf_numsrc;
>>> -	gf.gf_group = gf32.gf_group;
>>>  
>>> +	if (num > (len - size0) / sizeof(struct sockaddr_storage))
>>> +		num = (len - size0) / sizeof(struct sockaddr_storage);
>>> +	gf.gf_numsrc = num;
>>
>> Since this is exactly the same code added above, likely a common helper
>> would be useful.
> 
> Useful where else?

Just in these 2 functions, to avoid duplicating the logic.

Not a big deal, but it would feel nicer. Also the

	gf.gf_group = gf32.gf_group;

statement is moved around but such change is not needed, right?

>> I guess we don't care if this would break bad application passing optval
>> area properly sized for gf_numsrc sockets and a small optval, right? I
>> don't see how to eventually save them.
> 
> I couldn't see how to save them either, and if an application sends bad
> data we should be rejecting it, right?  Especially as this overflows
> things as-is :(

Agreed.

Thanks,

Paolo