Patch "ppp: limit MRU to 64K" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ppp: limit MRU to 64K

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ppp-limit-mru-to-64k.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d4ad8553dda5b183ef983ef62dd6e4c1af615d29
Author: Willem de Bruijn <willemb@xxxxxxxxxx>
Date:   Sun Nov 12 22:16:32 2023 -0500

    ppp: limit MRU to 64K
    
    [ Upstream commit c0a2a1b0d631fc460d830f52d06211838874d655 ]
    
    ppp_sync_ioctl allows setting device MRU, but does not sanity check
    this input.
    
    Limit to a sane upper bound of 64KB.
    
    No implementation I could find generates larger than 64KB frames.
    RFC 2823 mentions an upper bound of PPP over SDL of 64KB based on the
    16-bit length field. Other protocols will be smaller, such as PPPoE
    (9KB jumbo frame) and PPPoA (18190 maximum CPCS-SDU size, RFC 2364).
    PPTP and L2TP encapsulate in IP.
    
    Syzbot managed to trigger alloc warning in __alloc_pages:
    
            if (WARN_ON_ONCE_GFP(order > MAX_ORDER, gfp))
    
        WARNING: CPU: 1 PID: 37 at mm/page_alloc.c:4544 __alloc_pages+0x3ab/0x4a0 mm/page_alloc.c:4544
    
        __alloc_skb+0x12b/0x330 net/core/skbuff.c:651
        __netdev_alloc_skb+0x72/0x3f0 net/core/skbuff.c:715
        netdev_alloc_skb include/linux/skbuff.h:3225 [inline]
        dev_alloc_skb include/linux/skbuff.h:3238 [inline]
        ppp_sync_input drivers/net/ppp/ppp_synctty.c:669 [inline]
        ppp_sync_receive+0xff/0x680 drivers/net/ppp/ppp_synctty.c:334
        tty_ldisc_receive_buf+0x14c/0x180 drivers/tty/tty_buffer.c:390
        tty_port_default_receive_buf+0x70/0xb0 drivers/tty/tty_port.c:37
        receive_buf drivers/tty/tty_buffer.c:444 [inline]
        flush_to_ldisc+0x261/0x780 drivers/tty/tty_buffer.c:494
        process_one_work+0x884/0x15c0 kernel/workqueue.c:2630
    
    With call
    
        ioctl$PPPIOCSMRU1(r1, 0x40047452, &(0x7f0000000100)=0x5e6417a8)
    
    Similar code exists in other drivers that implement ppp_channel_ops
    ioctl PPPIOCSMRU. Those might also be in scope. Notably excluded from
    this are pppol2tp_ioctl and pppoe_ioctl.
    
    This code goes back to the start of git history.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: syzbot+6177e1f90d92583bcc58@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Willem de Bruijn <willemb@xxxxxxxxxx>
    Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c
index ea261a628786b..52d05ce4a2819 100644
--- a/drivers/net/ppp/ppp_synctty.c
+++ b/drivers/net/ppp/ppp_synctty.c
@@ -453,6 +453,10 @@ ppp_sync_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg)
 	case PPPIOCSMRU:
 		if (get_user(val, (int __user *) argp))
 			break;
+		if (val > U16_MAX) {
+			err = -EINVAL;
+			break;
+		}
 		if (val < PPP_MRU)
 			val = PPP_MRU;
 		ap->mru = val;