Dmitry Antipov 099502ca41 ppp: reject claimed-as-LCP but actually malformed packets ...

[ Upstream commit f2aeb7306a ]

Since 'ppp_async_encode()' assumes valid LCP packets (with code
from 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that
LCP packet has an actual body beyond PPP_LCP header bytes, and
reject claimed-as-LCP but actually malformed data otherwise.

Reported-by: syzbot+ec0723ba9605678b14bf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ec0723ba9605678b14bf
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-07-18 13:21:14 +02:00

..

bsd_comp.c

…

Kconfig

…

Makefile

…

ppp_async.c

ppp_async: limit MRU to 64K

2024-02-16 19:10:50 +01:00

ppp_deflate.c

…

ppp_generic.c

ppp: reject claimed-as-LCP but actually malformed packets

2024-07-18 13:21:14 +02:00

ppp_mppe.c

…

ppp_mppe.h

…

ppp_synctty.c

ppp: limit MRU to 64K

2023-11-28 17:19:51 +00:00

pppoe.c

…

pppox.c

…

pptp.c

…