[PATCH] net: slip: fix out-of-bounds access on short CSLIP packets

[Hui Peng]

In drivers/net/slip/slip.c, verify packet length before invoking
slhc_uncompress() / slhc_remember() on compressed SLIP frames so
truncated CSLIP headers cannot read or write past the receive buffer.

Fixes: b5451d783ade ("slip: Move the SLIP drivers")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index fdd6f63fb849..4389985979cf 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -335,7 +335,7 @@ static void sl_bump(struct slip *sl)
 			}
 			/* make sure we've reserved enough space for uncompress
 			   to use */
-			if (count + 80 > sl->buffsize) {
+			if (count + 120 > sl->buffsize) {
 				dev->stats.rx_over_errors++;
 				return;
 			}