[PATCH] ppp: fix bsd_decompress() OOB read and ppp_decompress_frame() headroom check
flat view
COLD22d
From: Hui Peng <hidden>
Date: 2026-09-19 21:52:36
Also in:
lkml
Subsystem:
networking drivers, ppp protocol drivers and compressors, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
In ppp_decompress_frame(), skb->data - 2 is passed to the decompressor
assuming at least 2 bytes of headroom exist for the PPP Address/Control
fields, and the returned decompressed length is only checked for len < 0
before indexing ns->data[2..3] and calling skb_pull_rcsum(skb, 2).
Ensure 2 bytes of headroom via pskb_expand_head(skb, 2, 0, GFP_ATOMIC),
reject decompressed frames shorter than PPP_HDRLEN (4 bytes), and check
isize >= PPP_HDRLEN + BSD_OVHD in bsd_decompress() before reading the
sequence number and header bytes.
Fixes: 224cf5ad14c0 ("ppp: Move the PPP drivers")
Assisted-by: LLM
Signed-off-by: Hui Peng <redacted>
---diff --git a/drivers/net/ppp/bsd_comp.c b/drivers/net/ppp/bsd_comp.c
index 63a6d251c746..03ee4ff4ec1b 100644
--- a/drivers/net/ppp/bsd_comp.c
+++ b/drivers/net/ppp/bsd_comp.c@@ -847,6 +847,8 @@ static int bsd_decompress (void *state, unsigned char *ibuf, int isize, int extra; db = (struct bsd_db *) state; + if (isize < PPP_HDRLEN + BSD_OVHD) + return DECOMP_ERROR; max_ent = db->max_ent; accm = 0; bitno = 32; /* 1st valid bit in accm */
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 1a610a18893b..f7af328b7bf8 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c@@ -2552,7 +2552,8 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb) /* Until we fix all the decompressor's need to make sure * data portion is linear. */ - if (!pskb_may_pull(skb, skb->len)) + if (!pskb_may_pull(skb, skb->len) || + pskb_expand_head(skb, 2, 0, GFP_ATOMIC)) goto err; if (proto == PPP_COMP) {
@@ -2576,7 +2577,7 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb) /* the decompressor still expects the A/C bytes in the hdr */ len = ppp->rcomp->decompress(ppp->rc_state, skb->data - 2, skb->len + 2, ns->data, obuff_size); - if (len < 0) { + if (len < PPP_HDRLEN) { /* Pass the compressed frame to pppd as an error indication. */ if (len == DECOMP_FATALERROR)