Some callers misinterpret copy_from_sockptr()'s return value. The function
follows copy_from_user(), i.e. returns 0 for success, or the number of
bytes not copied on error. Simply returning the result in a non-zero case
isn't usually what was intended.
Compile tested with CONFIG_LLC, CONFIG_AF_RXRPC, CONFIG_BT enabled.
Last patch probably belongs more to net-next, if any. Here as a RFC.
Suggested-by: Jakub Kicinski <kuba@xxxxxxxxxx>
Signed-off-by: Michal Luczaj <mhal@xxxxxxx>
---
Michal Luczaj (4):
bluetooth: Improve setsockopt() handling of malformed user input
llc: Improve setsockopt() handling of malformed user input
rxrpc: Improve setsockopt() handling of malformed user input
net: Comment copy_from_sockptr() explaining its behaviour
include/linux/sockptr.h | 2 ++
include/net/bluetooth/bluetooth.h | 9 ---------
net/bluetooth/hci_sock.c | 14 +++++++-------
net/bluetooth/iso.c | 10 +++++-----
net/bluetooth/l2cap_sock.c | 20 +++++++++++---------
net/bluetooth/rfcomm/sock.c | 9 ++++-----
net/bluetooth/sco.c | 11 ++++++-----
net/llc/af_llc.c | 15 ++++++++-------
net/rxrpc/af_rxrpc.c | 8 ++++----
9 files changed, 47 insertions(+), 51 deletions(-)
---
base-commit: cfaaa7d010d1fc58f9717fcc8591201e741d2d49
change-id: 20241114-sockptr-copy-fixes-3999eaa81aa1
Best regards,
--
Michal Luczaj <mhal@xxxxxxx>
