Willem de Bruijn 0735ea00b2 ppp: limit MRU to 64K ... [ Upstream commit c0a2a1b0d6 ] ppp_sync_ioctl allows setting device MRU, but does not sanity check this input. Limit to a sane upper bound of 64KB. No implementation I could find generates larger than 64KB frames. RFC 2823 mentions an upper bound of PPP over SDL of 64KB based on the 16-bit length field. Other protocols will be smaller, such as PPPoE (9KB jumbo frame) and PPPoA (18190 maximum CPCS-SDU size, RFC 2364). PPTP and L2TP encapsulate in IP. Syzbot managed to trigger alloc warning in __alloc_pages: if (WARN_ON_ONCE_GFP(order > MAX_ORDER, gfp)) WARNING: CPU: 1 PID: 37 at mm/page_alloc.c:4544 __alloc_pages+0x3ab/0x4a0 mm/page_alloc.c:4544 __alloc_skb+0x12b/0x330 net/core/skbuff.c:651 __netdev_alloc_skb+0x72/0x3f0 net/core/skbuff.c:715 netdev_alloc_skb include/linux/skbuff.h:3225 [inline] dev_alloc_skb include/linux/skbuff.h:3238 [inline] ppp_sync_input drivers/net/ppp/ppp_synctty.c:669 [inline] ppp_sync_receive+0xff/0x680 drivers/net/ppp/ppp_synctty.c:334 tty_ldisc_receive_buf+0x14c/0x180 drivers/tty/tty_buffer.c:390 tty_port_default_receive_buf+0x70/0xb0 drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:444 [inline] flush_to_ldisc+0x261/0x780 drivers/tty/tty_buffer.c:494 process_one_work+0x884/0x15c0 kernel/workqueue.c:2630 With call ioctl$PPPIOCSMRU1(r1, 0x40047452, &(0x7f0000000100)=0x5e6417a8) Similar code exists in other drivers that implement ppp_channel_ops ioctl PPPIOCSMRU. Those might also be in scope. Notably excluded from this are pppol2tp_ioctl and pppoe_ioctl. This code goes back to the start of git history. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Reported-by: syzbot+6177e1f90d92583bcc58@syzkaller.appspotmail.com Signed-off-by: Willem de Bruijn <willemb@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-11-28 17:19:51 +00:00
..
bsd_comp.c	net: ppp: remove leading spaces before tabs	2021-05-20 15:10:57 -07:00
Kconfig	net/pppoe: fix a typo for the PPPOE_HASH_BITS_1 definition	2023-06-06 13:28:30 +02:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
ppp_async.c	tty: ldops: unify to u8	2023-08-11 21:12:47 +02:00
ppp_deflate.c	ppp: deflate: Remove useless call "zlib_inflateEnd"	2021-03-30 16:59:30 -07:00
ppp_generic.c	driver core: class: remove module * from class_create()	2023-03-17 15:16:33 +01:00
ppp_mppe.c	mm, treewide: rename kzfree() to kfree_sensitive()	2020-08-07 11:33:22 -07:00
ppp_mppe.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
ppp_synctty.c	ppp: limit MRU to 64K	2023-11-28 17:19:51 +00:00
pppoe.c	net: ppp: Remove unnecessary (void*) conversions	2023-07-18 19:00:47 -07:00
pppox.c	compat_ioctl: pppoe: fix PPPOEIOCSFWD handling	2019-07-30 14:42:13 -07:00
pptp.c	net: ppp: Remove unnecessary (void*) conversions	2023-07-18 19:00:47 -07:00