[PATCH] net: lapb: fix uninitialized stack frame fields in lapb_decode()

[Hui Peng]

`lapb_decode()` populates a caller-allocated `struct lapb_frame frame`
on the stack of `lapb_data_input()`, but does not zero-initialize
`*frame`.

1. When `skb->data[0]` is not a valid LAPB address byte (`LAPB_ADDR_A`,
   `LAPB_ADDR_B`, `LAPB_ADDR_C`, or `LAPB_ADDR_D`), `frame->cr` is left
   uninitialized on the stack while `lapb_decode()` continues parsing
   and copies `frame->cr` into `lapb->frmr_data.cr` via
   `lapb_transmit_frmr()`, leaking 1 bit of kernel stack memory over the
   network.
2. When decoding an unnumbered (`LAPB_U`) or illegal frame in
   `LAPB_EXTENDED` mode, `frame->control[1]` is left uninitialized on
   the stack and copied into the outgoing `FRMR` frame by
   `lapb_transmit_frmr()`.

Zero-initialize `*frame` at the start of `lapb_decode()` and return `-1`
when `skb->data[0]` is not a valid LAPB address byte.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>

---
 net/lapb/lapb_subr.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/net/lapb/lapb_subr.c b/net/lapb/lapb_subr.c
index 592a22d86a97..8150f3583f15 100644
--- a/net/lapb/lapb_subr.c
+++ b/net/lapb/lapb_subr.c
@@ -106,6 +106,7 @@ int lapb_validate_nr(struct lapb_cb *lapb, unsigned short nr)
 int lapb_decode(struct lapb_cb *lapb, struct sk_buff *skb,
 		struct lapb_frame *frame)
 {
+	memset(frame, 0, sizeof(*frame));
 	frame->type = LAPB_ILLEGAL;
 
 	lapb_dbg(2, "(%p) S%d RX %3ph\n", lapb->dev, lapb->state, skb->data);
@@ -120,25 +121,33 @@ int lapb_decode(struct lapb_cb *lapb, struct sk_buff *skb,
 		if (lapb->mode & LAPB_DCE) {
 			if (skb->data[0] == LAPB_ADDR_D)
 				frame->cr = LAPB_COMMAND;
-			if (skb->data[0] == LAPB_ADDR_C)
+			else if (skb->data[0] == LAPB_ADDR_C)
 				frame->cr = LAPB_RESPONSE;
+			else
+				return -1;
 		} else {
 			if (skb->data[0] == LAPB_ADDR_C)
 				frame->cr = LAPB_COMMAND;
-			if (skb->data[0] == LAPB_ADDR_D)
+			else if (skb->data[0] == LAPB_ADDR_D)
 				frame->cr = LAPB_RESPONSE;
+			else
+				return -1;
 		}
 	} else {
 		if (lapb->mode & LAPB_DCE) {
 			if (skb->data[0] == LAPB_ADDR_B)
 				frame->cr = LAPB_COMMAND;
-			if (skb->data[0] == LAPB_ADDR_A)
+			else if (skb->data[0] == LAPB_ADDR_A)
 				frame->cr = LAPB_RESPONSE;
+			else
+				return -1;
 		} else {
 			if (skb->data[0] == LAPB_ADDR_A)
 				frame->cr = LAPB_COMMAND;
-			if (skb->data[0] == LAPB_ADDR_B)
+			else if (skb->data[0] == LAPB_ADDR_B)
 				frame->cr = LAPB_RESPONSE;
+			else
+				return -1;
 		}
 	}
 
-- 
2.55.0.1082.g2b9226bbc0-goog