From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D0BB3E1CE7; Fri, 10 Apr 2026 17:11:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775841082; cv=none; b=oS7Ws7bSma6lSixk4xNwuUYwCAZ2T4sXHuPUNvMmT2pLk3lOsqjalX72oPcwWCkJyF4niumQQp92hv1VmSHnnVjWJ88FFsJUPtwqS+9i4Lct+UhXfj5+isxsBItClPpzXdZBrbw/T64pBBclgW7SuJgdx3eNJRgNg8bGEoG4T6o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775841082; c=relaxed/simple; bh=mYIUZtZFHM8V6Qmy0sNWVV3DPCWZTFkkWg/yAONmQxI=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=qHah0YWXhPbrZGljidot9YtA3AtjRc/qnVGzWdY71zApRw5Qrem0J2H4I/66C5zW9AQAQlWgKDORIj7B5KMrodm6Sw4lwKN0KrdP0z0On0OPjY6jAWVkwndMRjvTRBWxpRLiRry8H1F30SYq0JDfXB2C+3Ju8fyydXnpxnur+Xk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=m0rH0ePo; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="m0rH0ePo" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 21E1FC19421; Fri, 10 Apr 2026 17:11:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775841082; bh=mYIUZtZFHM8V6Qmy0sNWVV3DPCWZTFkkWg/yAONmQxI=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=m0rH0ePoyvO/B/VkFb+zXG+KuUpPP+dre/Cxg+plqC4AK5CZqxvtoAG5wdjfdS+Ve fneygN85mSDJDxFuzQ2SN9D9QYB2Anj3hVTUU4n59dxqEekO5mc9ZUWGqhRKTNNzgc IrI4S3g2lPN2iWDLSx2CeuDh8HRwUY+E1R7S+r68/NHt/ydRH1bwBXGapAC08QkO42 esVKId8IsWfrj83on2bsrpm/Ej/yKjpiv/+KMXBMtlVe3GTojugRN00sUvib0vZOrj 0xJcOFf5eojqXucU8qeoV9QT+EFpacUG056Zm9q+nVN9EdpzFGJERkn2VpTXHLVmUe kSTfoxIxp4WNg== Date: Fri, 10 Apr 2026 18:11:15 +0100 From: Simon Horman To: Qingfang Deng Cc: linux-ppp@vger.kernel.org, Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Guillaume Nault , Breno Leitao , Kuniyuki Iwashima , Kees Cook , Sebastian Andrzej Siewior , Eric Woudstra , Sam Protsenko , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Paul Mackerras , Jaco Kroon , James Carlson , Wojciech Drewek , Marcin Szycik Subject: Re: [PATCH net v4 2/2] pppoe: drop PFC frames Message-ID: <20260410171115.GE469338@kernel.org> References: <20260410033627.93786-1-qingfang.deng@linux.dev> <20260410033627.93786-2-qingfang.deng@linux.dev> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260410033627.93786-2-qingfang.deng@linux.dev> On Fri, Apr 10, 2026 at 11:36:21AM +0800, Qingfang Deng wrote: > RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT > RECOMMENDED for PPPoE. In practice, pppd does not support negotiating > PFC for PPPoE sessions, and the current PPPoE driver assumes an > uncompressed (2-byte) protocol field. However, the generic PPP layer > function ppp_input() is not aware of the negotiation result, and still > accepts PFC frames. > > If a peer with a broken implementation or an attacker sends a frame with > a compressed (1-byte) protocol field, the subsequent PPP payload is > shifted by one byte. This causes the network header to be 4-byte > misaligned, which may trigger unaligned access exceptions on some > architectures. > > To reduce the attack surface, drop PPPoE PFC frames. Introduce > ppp_skb_is_compressed_proto() helper function to be used in both > ppp_generic.c and pppoe.c to avoid open-coding. > > Fixes: 7fb1b8ca8fa1 ("ppp: Move PFC decompression to PPP generic layer") > Signed-off-by: Qingfang Deng > --- > Changes in v4: > Update Fixes tag as suggested by AI review > Link to v3: https://lore.kernel.org/r/20260409031107.616630-2-qingfang.deng@linux.dev > Changes in v3: > Fix kdoc warning > Link to v2: https://lore.kernel.org/r/20260408024245.312732-1-qingfang.deng@linux.dev Reviewed-by: Simon Horman