Arnaud LecomteandGreg Kroah-Hartman
fbaffe8bcc
net: ppp: Add bound checking for skb data on ppp_sync_txmung
[ Upstream commit aabc6596ff ]
Ensure we have enough data in linear buffer from skb before accessing
initial bytes. This prevents potential out-of-bounds accesses
when processing short packets.
When ppp_sync_txmung receives an incoming package with an empty
payload:
(remote) gef➤ p *(struct pppoe_hdr *) (skb->head + skb->network_header)
$18 = {
type = 0x1,
ver = 0x1,
code = 0x0,
sid = 0x2,
length = 0x0,
tag = 0xffff8880371cdb96
}
from the skb struct (trimmed)
tail = 0x16,
end = 0x140,
head = 0xffff88803346f400 "4",
data = 0xffff88803346f416 ":\377",
truesize = 0x380,
len = 0x0,
data_len = 0x0,
mac_len = 0xe,
hdr_len = 0x0,
it is not safe to access data[2].
Reported-by: syzbot+29fc8991b0ecb186cf40@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=29fc8991b0ecb186cf40
Tested-by: syzbot+29fc8991b0ecb186cf40@syzkaller.appspotmail.com
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com>
Link: https://patch.msgid.link/20250408-bound-checking-ppp_txmung-v2-1-94bb6e1b92d0@arnaud-lcm.com
[pabeni@redhat.com: fixed subj typo]
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-04-25 10:45:09 +02:00
..
2025-03-28 21:59:54 +01:00
2025-04-10 14:37:42 +02:00
2025-04-25 10:45:08 +02:00
2025-04-10 14:37:26 +02:00
2025-03-22 12:50:37 -07:00
2025-03-13 12:58:28 +01:00
2025-03-13 12:58:37 +01:00
2025-03-13 12:58:36 +01:00
2025-03-13 12:58:37 +01:00
2025-04-10 14:37:32 +02:00
2025-03-22 12:50:37 -07:00
2025-04-07 10:06:37 +02:00
2025-04-10 14:37:25 +02:00
2025-04-10 14:37:32 +02:00
2025-04-10 14:37:33 +02:00
2025-04-10 14:37:26 +02:00
2025-04-10 14:37:39 +02:00
2025-03-13 12:58:33 +01:00
2025-04-25 10:45:08 +02:00
2025-04-10 14:37:37 +02:00
2025-03-22 12:50:38 -07:00
2025-04-10 14:37:38 +02:00
2025-04-10 14:37:32 +02:00
2025-03-28 21:59:54 +01:00
2025-04-10 14:37:34 +02:00
2025-03-07 16:45:49 +01:00
2025-04-10 14:37:33 +02:00
2025-04-10 14:37:31 +02:00
2025-03-22 12:50:46 -07:00
2025-02-17 09:40:09 +01:00
2025-02-17 09:40:38 +01:00
2025-04-10 14:37:32 +02:00
2025-02-17 09:40:38 +01:00
2025-03-22 12:50:47 -07:00
2025-04-10 14:37:44 +02:00
2025-04-10 14:37:38 +02:00
2025-04-07 10:06:37 +02:00
2025-04-10 14:37:32 +02:00
2025-03-13 12:58:37 +01:00
2025-04-10 14:37:42 +02:00
2025-02-27 04:10:53 -08:00
2025-04-25 10:45:09 +02:00
2025-04-10 14:37:42 +02:00
2025-04-25 10:45:09 +02:00
2025-02-27 04:10:47 -08:00
2025-03-13 12:58:22 +01:00
2025-04-10 14:37:29 +02:00
2025-03-07 16:45:47 +01:00
2025-04-10 14:37:32 +02:00
2025-04-10 14:37:42 +02:00
2025-04-10 14:37:31 +02:00
2025-03-22 12:50:40 -07:00
2025-02-08 09:52:38 +01:00
2025-02-17 09:40:41 +01:00
2025-02-17 09:40:31 +01:00
2025-03-13 12:58:27 +01:00
2025-03-28 21:59:54 +01:00
2025-04-10 14:37:31 +02:00
2025-04-07 10:06:36 +02:00
2025-02-17 09:40:41 +01:00
2025-03-22 12:50:42 -07:00
2025-04-10 14:37:41 +02:00
2025-03-13 12:58:37 +01:00
2025-03-28 21:59:55 +01:00
2025-04-10 14:37:32 +02:00
2025-03-13 12:58:40 +01:00
2025-04-10 14:37:34 +02:00
2025-02-27 04:10:51 -08:00
2025-04-10 14:37:26 +02:00
2025-04-10 14:37:34 +02:00
2025-04-07 10:06:36 +02:00
2025-04-10 14:37:33 +02:00
2025-02-21 13:57:27 +01:00
2025-04-10 14:37:32 +02:00
2025-04-10 14:37:29 +02:00
2025-03-13 12:58:37 +01:00
2025-02-08 09:52:25 +01:00
2025-03-22 12:50:42 -07:00