Re: [PATCH net-next 4/7] phonet: pep: do not write beyond optlen in getsockopt

[Rémi Denis-Courmont]

Le 16 juillet 2026 16:00:02 GMT+03:00, Breno Leitao <lei...@debian.org> a écrit 
:
>pep_getsockopt() clamps the reported length to the caller's buffer with
>min_t(), but then stores the value with put_user(val, (int __user *)
>optval), which always writes sizeof(int) bytes. A getsockopt() call with
>an optlen smaller than sizeof(int) thus reports the clamped length yet
>writes a full int, one to three bytes past the user buffer.
>
>Write the value with copy_to_user() bounded by len, so at most optlen
>bytes are copied, matching the length reported back to userspace.
>
>Fixes: 02a47617cdce ("Phonet: implement GPRS virtual interface over PEP 
>socket")
>Signed-off-by: Breno Leitao <lei...@debian.org>

Acked-by: Rémi Denis-Courmont <r...@remlab.net>