[PATCH] ppp: pptp: fix out-of-bounds read on short payload_len in pptp_rcv_core()

[Hui Peng]

In `pptp_rcv_core()`, `pskb_may_pull(skb, headersize + payload_len)`
only verifies that `skb->len >= headersize + payload_len` without
checking that `payload_len` itself is large enough for the subsequent
PPP header accesses.

When a GRE packet arrives with `payload_len == 0` (or `1`) and `skb->len
   == headersize + payload_len`, `pskb_may_pull()` succeeds and `payload
   = skb->data + headersize` points to `skb->tail`. Immediately
   afterwards:
1. If `seq` is out-of-window, `pptp_rcv_core()` reads `payload[0]`,
   `payload[1]`, `PPP_PROTOCOL(payload)` (`payload[2..3]`), and
   `payload[4]` (up to 5 bytes past `skb->tail`) to check for an LCP
   Echo packet.
2. If `seq` is in-window, `pptp_rcv_core()` reads `payload[0]` and
   `payload[1]` (up to 2 bytes past `skb->tail`) to check for the PPP
   address and control bytes.

Require `payload_len >= 2` before pulling the payload, and require
`payload_len >= 5` before inspecting `payload[0..4]` for LCP Echo
frames.

Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>

---
 drivers/net/ppp/pptp.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index a797a0606f6b..2f979294490d 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -310,6 +310,8 @@ static int pptp_rcv_core(struct sock *sk, struct sk_buff *skb)
 	payload_len = ntohs(header->payload_len);
 	seq         = ntohl(header->seq);
 
+	if (payload_len < 2)
+		goto drop;
 	/* check for incomplete packet (length smaller than expected) */
 	if (!pskb_may_pull(skb, headersize + payload_len))
 		goto drop;
@@ -317,9 +319,11 @@ static int pptp_rcv_core(struct sock *sk, struct sk_buff *skb)
 	payload = skb->data + headersize;
 	/* check for expected sequence number */
 	if (seq < opt->seq_recv + 1 || WRAPPED(opt->seq_recv, seq)) {
-		if ((payload[0] == PPP_ALLSTATIONS) && (payload[1] == PPP_UI) &&
-				(PPP_PROTOCOL(payload) == PPP_LCP) &&
-				((payload[4] == PPP_LCP_ECHOREQ) || (payload[4] == PPP_LCP_ECHOREP)))
+		if (payload_len >= 5 &&
+		    payload[0] == PPP_ALLSTATIONS && payload[1] == PPP_UI &&
+		    PPP_PROTOCOL(payload) == PPP_LCP &&
+		    (payload[4] == PPP_LCP_ECHOREQ ||
+		     payload[4] == PPP_LCP_ECHOREP))
 			goto allow_packet;
 	} else {
 		opt->seq_recv = seq;