Re: [PATCH net 0/2] net: mcast: do not write past optlen in the source filter getsockopt

[Simon Horman]

On Thu, Aug 06, 2026 at 02:41:59AM -0700, Breno Leitao wrote:
> getsockopt() on the multicast source filter options writes past the
> buffer the caller declared. Only the fixed header is checked against
> optlen. The number of sources copied out comes from gf_numsrc/
> imsf_numsrc, read back from optval, and nothing bounds that count by
> the space left in the buffer.
> 
> I hit this while converting the mcast getsockopt paths to sockopt_t.
> Fixing it against 'net' first, so the fix is settled on its own before
> the conversion goes on top.
> 
> Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>
> ---
> Breno Leitao (2):
>       ipv4: mcast: getsockopt: do not overwrite past optlen
>       ipv6: mcast: do not write past optlen in the source filter getsockopt
> 
>  net/ipv4/ip_sockglue.c   | 16 ++++++++++++++++
>  net/ipv6/ipv6_sockglue.c | 11 +++++++++++
>  2 files changed, 27 insertions(+)

For the series:

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>