ppp: reject claimed-as-LCP but actually malformed packets

stable inclusion
from stable-v4.19.318
commit 97d1efd8be26615ff680cdde86937d5943138f37
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEN2
CVE: CVE-2024-41044

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=97d1efd8be26615ff680cdde86937d5943138f37



---------------------------

[ Upstream commit f2aeb7306a898e1cbd03963d376f4b6656ca2b55 ]

Since 'ppp_async_encode()' assumes valid LCP packets (with code
from 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that
LCP packet has an actual body beyond PPP_LCP header bytes, and
reject claimed-as-LCP but actually malformed data otherwise.

Reported-by:  <syzbot+ec0723ba9605678b14bf@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=ec0723ba9605678b14bf


Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Liu Jian <liujian56@huawei.com>