ipv6: do compat setsockopt for MCAST_MSFILTER directly
authorAl Viro <viro@zeniv.linux.org.uk>
Mon, 30 Mar 2020 20:40:04 +0000 (16:40 -0400)
committerAl Viro <viro@zeniv.linux.org.uk>
Thu, 21 May 2020 00:31:29 +0000 (20:31 -0400)
similar to the ipv4 counterpart of that patch - the same
trick used to align the tail array properly.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
net/ipv6/ipv6_sockglue.c

index 7d3ecc0..2b5029d 100644 (file)
@@ -980,9 +980,55 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname,
        case MCAST_LEAVE_SOURCE_GROUP:
        case MCAST_BLOCK_SOURCE:
        case MCAST_UNBLOCK_SOURCE:
-       case MCAST_MSFILTER:
                return compat_mc_setsockopt(sk, level, optname, optval, optlen,
                        ipv6_setsockopt);
+       case MCAST_MSFILTER:
+       {
+               const int size0 = offsetof(struct compat_group_filter, gf_slist);
+               struct compat_group_filter *gf32;
+               void *p;
+               int n;
+
+               if (optlen < size0)
+                       return -EINVAL;
+               if (optlen > sysctl_optmem_max - 4)
+                       return -ENOBUFS;
+
+               p = kmalloc(optlen + 4, GFP_KERNEL);
+               if (!p)
+                       return -ENOMEM;
+
+               gf32 = p + 4; /* we want ->gf_group and ->gf_slist aligned */
+               if (copy_from_user(gf32, optval, optlen)) {
+                       err = -EFAULT;
+                       goto mc_msf_out;
+               }
+
+               n = gf32->gf_numsrc;
+               /* numsrc >= (4G-140)/128 overflow in 32 bits */
+               if (n >= 0x1ffffffU ||
+                   n > sysctl_mld_max_msf) {
+                       err = -ENOBUFS;
+                       goto mc_msf_out;
+               }
+               if (offsetof(struct compat_group_filter, gf_slist[n]) > optlen) {
+                       err = -EINVAL;
+                       goto mc_msf_out;
+               }
+
+               rtnl_lock();
+               lock_sock(sk);
+               err = ip6_mc_msfilter(sk, &(struct group_filter){
+                               .gf_interface = gf32->gf_interface,
+                               .gf_group = gf32->gf_group,
+                               .gf_fmode = gf32->gf_fmode,
+                               .gf_numsrc = gf32->gf_numsrc}, gf32->gf_slist);
+               release_sock(sk);
+               rtnl_unlock();
+mc_msf_out:
+               kfree(p);
+               return err;
+       }
        }
 
        err = do_ipv6_setsockopt(sk, level, optname, optval, optlen);