Re: [PATCH] pptp: reject payloads shorter than the PPP protocol field

[Chuyf26 <Chuyf26@linux.alibaba.com>]

Simon,

you are right. I double-checked the arithmetic: when len == 1,
pskb_may_pull(skb, 1 + len) only guarantees 2 bytes, so p[1] is read
one byte past the validated area, but the pre-existing
len < p[1] + 2 check rejects the frame for every possible value of
that byte, and the len < 2 clause only hides the read behind
short-circuit evaluation. There is no control-flow change, so this is
hardening at best rather than a fix, and given the read stays inside
the skb allocation I am withdrawing this patch instead of resubmitting
it for net-next without a Fixes tag.

The point in finding 2 about the p[1] / p[2] mismatch is valid, but
as there is no memory-safety consequence I do not plan to pursue it
here either.

The pptp patch from the same series is addressed in a separate reply.

Chuyf26