[PATCH] ppp: fix bsd_decompress() OOB read and ppp_decompress_frame() headroom check

[Hui Peng]

In ppp_decompress_frame(), skb->data - 2 is passed to the decompressor
assuming at least 2 bytes of headroom exist for the PPP Address/Control
fields, and the returned decompressed length is only checked for len < 0
before indexing ns->data[2..3] and calling skb_pull_rcsum(skb, 2).

Ensure 2 bytes of headroom via pskb_expand_head(skb, 2, 0, GFP_ATOMIC),
reject decompressed frames shorter than PPP_HDRLEN (4 bytes), and check
isize >= PPP_HDRLEN + BSD_OVHD in bsd_decompress() before reading the
sequence number and header bytes.

Fixes: 224cf5ad14c0 ("ppp: Move the PPP drivers")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
diff --git a/drivers/net/ppp/bsd_comp.c b/drivers/net/ppp/bsd_comp.c
index 63a6d251c746..03ee4ff4ec1b 100644
--- a/drivers/net/ppp/bsd_comp.c
+++ b/drivers/net/ppp/bsd_comp.c
@@ -847,6 +847,8 @@ static int bsd_decompress (void *state, unsigned char *ibuf, int isize,
     int extra;
 
     db       = (struct bsd_db *) state;
+	if (isize < PPP_HDRLEN + BSD_OVHD)
+		return DECOMP_ERROR;
     max_ent  = db->max_ent;
     accm     = 0;
     bitno    = 32;		/* 1st valid bit in accm */
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 1a610a18893b..f7af328b7bf8 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2552,7 +2552,8 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb)
 	/* Until we fix all the decompressor's need to make sure
 	 * data portion is linear.
 	 */
-	if (!pskb_may_pull(skb, skb->len))
+	if (!pskb_may_pull(skb, skb->len) ||
+	    pskb_expand_head(skb, 2, 0, GFP_ATOMIC))
 		goto err;
 
 	if (proto == PPP_COMP) {
@@ -2576,7 +2577,7 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb)
 		/* the decompressor still expects the A/C bytes in the hdr */
 		len = ppp->rcomp->decompress(ppp->rc_state, skb->data - 2,
 				skb->len + 2, ns->data, obuff_size);
-		if (len < 0) {
+		if (len < PPP_HDRLEN) {
 			/* Pass the compressed frame to pppd as an
 			   error indication. */
 			if (len == DECOMP_FATALERROR)