tty: n_gsm: fix possible out-of-bounds in gsm0_receive()

stable inclusion
from stable-v6.6.33
commit 774d83b008eccb1c48c14dc5486e7aa255731350
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TAHR
CVE: CVE-2024-36016

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=774d83b008eccb1c48c14dc5486e7aa255731350



--------------------------------

commit 47388e807f85948eefc403a8a5fdc5b406a65d5a upstream.

Assuming the following:
- side A configures the n_gsm in basic option mode
- side B sends the header of a basic option mode frame with data length 1
- side A switches to advanced option mode
- side B sends 2 data bytes which exceeds gsm->len
  Reason: gsm->len is not used in advanced option mode.
- side A switches to basic option mode
- side B keeps sending until gsm0_receive() writes past gsm->buf
  Reason: Neither gsm->state nor gsm->len have been reset after
  reconfiguration.

Fix this by changing gsm->count to gsm->len comparison from equal to less
than. Also add upper limit checks against the constant MAX_MRU in
gsm0_receive() and gsm1_receive() to harden against memory corruption of
gsm->len and gsm->mru.

All other checks remain as we still need to limit the data according to the
user configuration and actual payload size.

Reported-by:  <j51569436@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218708


Tested-by:  <j51569436@gmail.com>
Fixes: e1eaea46 ("tty: n_gsm line discipline")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20240424054842.7741-1-daniel.starke@siemens.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Cui GaoSheng <cuigaosheng1@huawei.com>