Re: [PATCH] ppp: fix bsd_decompress() OOB read and ppp_decompress_frame() headroom check

On Sat, 19 Sep 2026 21:52:33 +0000, Hui Peng wrote:

In ppp_decompress_frame(), skb->data - 2 is passed to the decompressor
assuming at least 2 bytes of headroom exist for the PPP Address/Control
fields, and the returned decompressed length is only checked for len < 0
before indexing ns->data[2..3] and calling skb_pull_rcsum(skb, 2).

Ensure 2 bytes of headroom via pskb_expand_head(skb, 2, 0, GFP_ATOMIC),
reject decompressed frames shorter than PPP_HDRLEN (4 bytes), and check
isize >= PPP_HDRLEN + BSD_OVHD in bsd_decompress() before reading the
sequence number and header bytes.

Fixes: 224cf5ad14c0 ("ppp: Move the PPP drivers")
Assisted-by: LLM
Signed-off-by: Hui Peng <redacted>
---

You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem, how to document usage of LLM and how what you should not
do if this was posted in a good faith.

Best regards,
Krzysztof