[PATCH net] net/netlink: fix NETLINK_LIST_MEMBERSHIPS group array length check

[Pedro Tammela <pctammela@mojatatu.com>]

For the socket option 'NETLINK_LIST_MEMBERSHIPS' the length is defined
as the number of u32 required to represent the whole bitset.
User space then usually queries the required size and issues a subsequent
getsockopt call with the correct parameters[1].

The current code has an unit mismatch between 'len' and 'pos', where
'len' is the number of u32 in the passed array while 'pos' is the
number of bytes iterated in the groups bitset.
For netlink groups greater than 32, which from a quick glance
is a rare occasion, the mismatch causes the misreport of groups e.g.
if a rtnl socket is a member of group 34, it's reported as not a member
(all 0s).

[1] https://github.com/systemd/systemd/blob/9c9b9b89151c3e29f3665e306733957ee3979853/src/libsystemd/sd-netlink/netlink-socket.c#L26

Fixes: b42be38b2778 ("netlink: add API to retrieve all group memberships")
Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
---
 net/netlink/af_netlink.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index c87804112d0c..de21ddd5bf9a 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1765,10 +1765,11 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
 		break;
 	case NETLINK_LIST_MEMBERSHIPS: {
 		int pos, idx, shift, err = 0;
+		int blen = len * sizeof(u32);
 
 		netlink_lock_table();
 		for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
-			if (len - pos < sizeof(u32))
+			if (blen - pos < sizeof(u32))
 				break;
 
 			idx = pos / sizeof(unsigned long);
-- 
2.39.2