AZL-97070

In the Linux kernel, the following vulnerability has been resolved:

net/atm: fix slab-out-of-bounds read in vcc_setsockopt()

vcc_setsockopt() contained an ineffective optlen check: if (__SOLEVELMATCH(optname, level) && optlen != _SOSIZE(optname)) return -EINVAL;

If __SOLEVELMATCH(optname, level) evaluated to false (e.g. if the caller passed a mismatched level), the length check optlen != _SOSIZE(optname) was short-circuited and bypassed. Execution then fell through to switch(optname), calling copyfromsockptr() assuming optval contained sufficient space.

Furthermore, even if level matched, a cgroup BPF setsockopt filter could shrink optlen after entry. Because copyfromsockptr() on kernel pointers uses memcpy(), this leads to a KASAN slab-out-of-bounds read when optlen is smaller than the expected structure size.

Fix this by using copysafefromsockptr(), which unconditionally validates that optlen is at least the expected size before copying. Also change the local 'value' variable type from 'unsigned long' to 'int' so that SOSETCLP matches its sizeof(int) ABI encoding on 64-bit systems.