Re: [PATCH net-next 4/7] phonet: pep: d o not write beyond optlen in getsockopt

Le 16 juillet 2026 16:00:02 GMT+03:00, Breno Leitao <leitao@debian=2Eorg> =
a =C3=A9crit :
>pep_getsockopt() clamps the reported length to the caller's buffer with
>min_t(), but then stores the value with put_user(val, (int __user *)
>optval), which always writes sizeof(int) bytes=2E A getsockopt() call wit=
h
>an optlen smaller than sizeof(int) thus reports the clamped length yet
>writes a full int, one to three bytes past the user buffer=2E
>
>Write the value with copy_to_user() bounded by len, so at most optlen
>bytes are copied, matching the length reported back to userspace=2E
>
>Fixes: 02a47617cdce ("Phonet: implement GPRS virtual interface over PEP s=
ocket")
>Signed-off-by: Breno Leitao <leitao@debian=2Eorg>

Acked-by: R=C3=A9mi Denis-Courmont <remi@remlab=2Enet>