Some callers misinterpret copy_from_sockptr()'s return value. The function follows copy_from_user(), i.e. returns 0 for success, or the number of bytes not copied on error. Simply returning the result in a non-zero case isn't usually what was intended. Compile tested with CONFIG_LLC, CONFIG_AF_RXRPC, CONFIG_BT enabled. Last patch probably belongs more to net-next, if any. Here as a RFC. Suggested-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Michal Luczaj <mhal@xxxxxxx> --- Changes in v2: - Fix the fix of llc_ui_setsockopt() - Switch "bluetooth:" to "Bluetooth:" [bluez.test.bot] - Collect Reviewed-by [Luiz Augusto von Dentz] - Link to v1: https://lore.kernel.org/r/20241115-sockptr-copy-fixes-v1-0-d183c87fcbd5@xxxxxxx --- Michal Luczaj (4): Bluetooth: Improve setsockopt() handling of malformed user input llc: Improve setsockopt() handling of malformed user input rxrpc: Improve setsockopt() handling of malformed user input net: Comment copy_from_sockptr() explaining its behaviour include/linux/sockptr.h | 2 ++ include/net/bluetooth/bluetooth.h | 9 --------- net/bluetooth/hci_sock.c | 14 +++++++------- net/bluetooth/iso.c | 10 +++++----- net/bluetooth/l2cap_sock.c | 20 +++++++++++--------- net/bluetooth/rfcomm/sock.c | 9 ++++----- net/bluetooth/sco.c | 11 ++++++----- net/llc/af_llc.c | 8 ++++---- net/rxrpc/af_rxrpc.c | 8 ++++---- 9 files changed, 43 insertions(+), 48 deletions(-) --- base-commit: ea301aec8bb718b02b68761d2229fc12c9fefa29 change-id: 20241114-sockptr-copy-fixes-3999eaa81aa1 Best regards, -- Michal Luczaj <mhal@xxxxxxx>
